Systems And Methods For Managing Information Associated With Legal, Compliance And Regulatory Risk

ABSTRACT

Some embodiments include a system, method, apparatus and means for managing information associated with risk. In some embodiments, information associated with risk is collected, analyzed, stored, and disseminated. According to some embodiments, the information associated with risk is utilized to identify risk.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.10/941,742 filed Sep. 15, 2004 and entitled “Systems And Methods ForManaging Information Associated With Legal, Compliance And RegulatoryRisk,” which is based on, and hereby claims benefit of and priority to,U.S. Provisional Patent Application Ser. No. 60/585,343, filed on Jul.2, 2004, all of which are hereby incorporated by reference in theirentirety for all purposes.

BACKGROUND

Embodiments relate to the management of information associated withrisk. In particular, some embodiments relate to the collection,analysis, storage, and dissemination of information associated withrisk. Some embodiments are directed to the determination, assessment,and/or analysis of risk by utilizing the information associated withrisk.

Advances in communication and computing as well as the growingintegration of economies and societies around the world have increasedthe complexity of operating a business or other institution. In simplertimes, a company selling machine parts generally knew each of itscustomers and was primarily concerned with the credit risk posed by eachcustomer (i.e., the risk that the customer did not pay for the part).Thanks to the Internet and advances in communication and transportation,the company may now sell its machine parts around the world to unknownbuyers. The company is still concerned about the credit risk posed byeach customer, but is also concerned about other risks associated withconducting business with each customer, such as regulatory, political orreputational risk. For example, is the sale aiding a criminal act? Couldit violate any laws? Is the transaction somehow associated with aterrorist or criminal organization?

Businesses and other institutions are generally well-equipped to manageand assess credit risk (e.g., by performing credit checks, requiringpayment on certain terms such as in advance or under a letter of credit,etc.). However, these entities are generally not able to systematicallyevaluate and assess the other risks (such as political, regulatory,and/or reputational risks) that may be associated with transactions orother relationships. It would be desirable to provide systems, methods,apparatus and means for collecting, storing, managing and utilizinginformation associated with risk.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system according to some embodiments;

FIG. 2 is a block diagram of a system according to some embodiments;

FIG. 3 is a flow diagram of a method according to some embodiments;

FIG. 4 is a block diagram of a system according to some embodiments;

FIG. 5 is a flow diagram of a method according to some embodiments;

FIG. 6 is a block diagram of a system according to some embodiments;

FIG. 7 is a block diagram of a system according to some embodiments;

FIG. 8 is a flow diagram of a method according to some embodiments;

FIG. 9 is a block diagram of a system according to some embodiments;

FIG. 10 is a block diagram of a system according to some embodiments;

FIG. 11 is a flow diagram of a method according to some embodiments;

FIG. 12 is a block diagram of a system according to some embodiments;

FIG. 13 is a block diagram of a system according to some embodiments;

FIG. 14 is a flow diagram of a method according to some embodiments;

FIG. 15 is a block diagram of a system according to some embodiments;

FIG. 16 is a block diagram of a data storage structure according to someembodiments;

FIG. 17 is a block diagram of a portion of a data storage structureaccording to some embodiments;

FIG. 18 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 19 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 20 is a block diagram of a portion of a data storage structureaccording to some embodiments;

FIG. 21 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 22 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 23 is a block diagram of a portion of a data storage structureaccording to some embodiments;

FIG. 24 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 25 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 26 is a block diagram of a portion of a data storage structureaccording to some embodiments;

FIG. 27 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 28 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 29 is a block diagram of a portion of a data storage structureaccording to some embodiments;

FIG. 30 is a schema diagram of an exemplary portion of a data storagestructure according to some embodiments;

FIG. 31 is a diagram of exemplary database tables according to someembodiments;

FIG. 32 is a diagram of exemplary database tables according to someembodiments;

FIG. 33 is a diagram of exemplary database tables according to someembodiments;

FIG. 34 is a diagram of exemplary database tables according to someembodiments;

FIG. 35 is a diagram of exemplary database tables according to someembodiments;

FIG. 36 is a block diagram of a system according to some embodiments;

FIG. 37 is a flow diagram of a method according to some embodiments;

FIG. 38 is a block diagram of a system according to some embodiments;

FIG. 39 is a block diagram of a system according to some embodiments;

FIG. 40 is a flow diagram of a method according to some embodiments;

FIG. 41 is a block diagram of a system according to some embodiments;

FIG. 42 is a diagram of an exemplary screen display according to someembodiments;

FIG. 43 is a diagram of an exemplary screen display according to someembodiments;

FIG. 44 is a flow diagram of a method according to some embodiments;

FIG. 45 is a block diagram of an apparatus according to someembodiments; and

FIG. 46 is a block diagram of an apparatus according to someembodiments.

DETAILED DESCRIPTION

To alleviate the problems inherent in the prior art, embodiments providesystems, methods, apparatus and means for managing informationassociated with risk. In some embodiments, risk may be identified,determined, assessed, and/or otherwise analyzed. Applicants haverecognized that there is a need for systems, methods, apparatus andmeans for managing information associated with risk. In addition,Applicants have recognized that there is a need for a data structurethat facilitates the identification of risk. Applicants have furtherrealized that there is a need for systems, methods, apparatus and meansfor determining and/or assisting in the determination of risk.

One benefit of some embodiments is that information associated with riskmay be collected from a wide variety of different types of informationsources, assessed for relevance, checked to ensure the information isnot redundant, and stored in a specially configured data structure. As aresult, users such as financial institutions, businesses, governmentagencies, or the like may access the information to determine a riskassociated with any given entity, object, and/or transaction. Someembodiments provide benefits such as automatically determining riskand/or automatically determining actions to be taken based on the risk.Other features and advantages that are derived from some embodimentswill become apparent upon reading this disclosure.

TERMS AND DEFINITIONS

Some embodiments described herein are associated with a “networkdevice”. As used herein, the phrase “network device” may refer to anydevice that can communicate via a network. Examples of network devicesinclude a Personal Computer (PC), a workstation, a server, a printer, ascanner, a facsimile machine, a copier, a Personal Digital Assistant(PDA), a storage device (e.g., a disk drive), a hub, a router, a switch,and a communication device (e.g., a modem, a wireless phone, etc.).Network devices may comprise one or more network components. As usedherein, the term “network component” may refer to a network device, or acomponent, piece, portion, or combination of network devices. Examplesof network components may include a Static Random Access Memory (SRAM)device or module, a network processor, and a network communication path,connection, port, or cable.

In addition, some embodiments are associated with a “network” or a“communication network”. As used herein, the terms “network” and“communication network” may be used interchangeably and may refer to anyobject, entity, component, device, and/or any combination thereof thatpermits, facilitates, and/or otherwise contributes to or is associatedwith the transmission of messages, packets, signals, and/or other formsof information between and/or within one or more network devices.Networks may be or include a plurality of interconnected networkdevices. In some embodiments, networks may be hard-wired, wireless,virtual, neural, and/or of any other configuration and/or type that isor becomes known. Communication networks may include, for example, oneor more networks configured to operate in accordance with the FastEthernet LAN transmission standard 802.3-2002® published by theInstitute of Electrical and Electronics Engineers (IEEE).

Further, some embodiments herein are associated with “information” or“data”. As used herein, the terms “information” and “data” may be usedinterchangeably and may refer to any data, text, voice, video, image,message, bit, packet, pulse, tone, waveform, and/or other type orconfiguration of signal and/or information. Information may be orinclude information packets transmitted, for example, in accordance withthe Internet Protocol Version 6 (IPv6) standard as defined by “InternetProtocol Version 6 (IPv6) Specification” RFC 1883, published by theInternet Engineering Task Force (IETF), Network Working Group, S.Deering et al. (December 1995). Information may, according to someembodiments, be compressed, encrypted, and/or otherwise packaged ormanipulated in accordance with any method that is or becomes known.

Some embodiments described herein are associated with “informationindicative of” or “indicia” of information associated with a subject,item, entity, and/or other object and/or idea. As used herein, thephrases “information indicative of” and “indicia” may be used to referto any information that represents, describes, and/or is otherwiseassociated with a related entity, subject, or object. Indicia ofinformation may include, for example, a code, a reference, a link, asignal, an identifier, and/or any combination thereof and/or any otherinformative representation associated with the information. In someembodiments, indicia of information (or indicative of the information)may be or include the information itself and/or any portion or componentof the information.

In addition, some embodiments are associated with identifying, analyzingand utilizing information associated with “risk”. As used herein, theterm “risk” may generally refer to any possibility, chance, and/orlikelihood of incurring and/or encountering peril, loss, hazard, danger,and/or injury. In some embodiments, “risk” may refer to any actual,perceived, inherent, intrinsic, and/or other form or type of peril,loss, hazard, danger, and/or injury. According to some embodiments,“risk” may refer to any individual, item, device, event, agent,organization, and/or other object or entity that may contribute to,cause, result from, and/or otherwise be associated with any type or formof risk. Risk may, according to some embodiments, be associated with anytype and/or aspect of possibility of peril, loss, hazard, danger, and/orinjury. Examples of risk may include, but are not limited to, financialrisk, political risk, risk of injury, risk of theft, risk of damage,risk of terrorism, risk to reputation, regulatory risk, legal risk, warrisk, and environmental risk.

Upon reading this disclosure, those skilled in the art will recognizethat embodiments of the present invention may be used to identify,analyze, and utilize other types of information.

Some embodiments herein are associated with “risk segments” or “key risksegments”. As used herein, the terms “risk segment” and “key risksegment” may be used interchangeably and may generally refer to anymetric, item, identifier, category, and/or any other type of informationthat is determined and/or otherwise identified to be associated with thedetermination of risk. In some embodiments for example, risk segmentsmay be or include any category and/or type of information that isdetermined to affect and/or be indicative of risk. Key risk segmentsmay, for example, be important factors that are desirable and/ornecessary to the analysis, assessment, and/or determination of risk. Insome embodiments, key risk segments may include, but are not limited to,information associated with persons, items, organizations,relationships, events, and/or addresses.

System Overview

Referring first to FIG. 1, a block diagram of a system 100 to identify,analyze and utilize information associated with risk is shown. Thevarious systems described herein are depicted for use in explanation,but not limitation, of described embodiments. Different types, layouts,quantities, and configurations of any of the systems described hereinmay be used without deviating from the scope of some embodiments of thepresent invention.

System 100 may comprise, for example, a risk server 102, one or moreinformation source devices 104 a-n, and/or one or more user devices 106a-n. In some embodiments, the risk server 102 may be or include multipleservers and/or devices (e.g., network devices) that may be, for example,distributed and/or otherwise coupled and/or connected. According to someembodiments, fewer or more components than are shown in FIG. 1 may beincluded within system 100. In some embodiments, any of the components102, 104, 106 may be or include one or more network devices and/or maybe configured in any manner that is or becomes known.

The risk server 102 may, according to some embodiments, be a computerserver having one or processors as are commonly known and used in theart. In some embodiments, the risk server 102 may be configured and/oradapted to identify, analyze and utilize information associated withrisk. For example, the risk server 102 may contain program code and/orother instructions or components directed to various processes toidentify, analyze and utilize information associated with risk. In someembodiments, code stored by the risk server 102 may, for example,collect information from one or more of the information source devices104 a-n. In some embodiments, the information may be collected,retrieved, received from, harvested from, extracted from, and/orotherwise obtained from an information source device 104. According tosome embodiments, the information may be or include information that isnot associated with risk, information that is associated with risk,information indicative of risk, and/or any combination thereof.

In some embodiments, the risk server 102 may conduct and/or facilitatean identification, assessment, and/or analysis of the risk relevancy ofinformation received from information source devices 104. For example,the risk server 102 may perform key word searches and analyses ofreceived information to identify information that is relevant to risk(where the relevance is defined by an operator or administrator of thesystem). In some embodiments, the analysis of information is performedin an automated fashion by performing automated key word searches andpredicate analyses on data packets and information obtained frominformation source devices 104. Information analyzed by the risk server102 may, in some embodiments, be checked to determine whether it isredundant or cumulative with information previously analyzed andcollected by the risk server 102. Information that is both relevant andnon-redundant is formatted and stored in a database of the risk server.

This database of risk-relevant information may be used in a number ofdifferent ways. For example, the risk server 102 may receive a query orother information from one or more user devices 106 a-n. In someembodiments, the query may be presented to determine whether a person,transaction, place, or other activity is risky. As a specific example, afinancial institution may present a query to determine whether a personassociated with a proposed financial transaction poses a political orregulatory risk to the financial institution. Embodiments allow suchqueries to be performed and responses to be provided based on currentand up to date information that has been analyzed for itsrisk-relevance. Other types of queries and uses of the data will bedescribed further below. Still others will become apparent to thoseskilled in the art upon reading this disclosure.

The risk server 102 may, according to some embodiments, utilize thequery and/or other received information to determine, compute, look up,derive, and/or otherwise identify risk relevant information. Informationindicative of or associated with the identified risk (e.g., a riskassessment, a computed risk factor, background materials, articles,alerts, etc.) may then, for example, be provided to, transmitted to,sent to, and/or otherwise made available to one or more of the userdevices 106 a-n.

The information source devices 104 a-n may, according to someembodiments, be or include any type or configuration of devices (e.g.,network devices) that are associated with the storage, delivery,presentation, sale, and/or management of information, and/or areotherwise associated with information. In some embodiments, one or moreof the information source devices 104 a-n may be or include devicesowned, operated by, operated on behalf of, and/or otherwise associatedwith one or more news and/or press organizations, businesses, groups,and/or individuals. The information source device 104 a may be orinclude, for example, a device operated by a commercial informationsource such as the Associated Press (AP) or a governmental informationsource such as the United States Department of the Treasury's Office ofForeign Assets Control (OFAC), the United States Federal Bureau ofInvestigation, the Bank of England, or the European Union. In someembodiments the information source device 104 a may be operated by acommercial information provider such as Jane's™ Information Group. Theinformation source device 104 may also or alternatively encompass printand/or other media that is entered into a computer system manually orautomatically.

According to some embodiments, the user devices 106 a-n may be orinclude any type or configuration of devices (e.g., network devices)that are associated with one or more users. For example, the user device106 a may be or include a PC, PDA, and/or wireless telephone owned,operated by, and/or operated on behalf of a user. In some embodiments auser may be or include any individual, group, organization, business,government, and/or other entity or combination of entities that desiresaccess to information associated with risk and/or desires an assessment,determination, and/or identification of risk. Users may include, forexample, financial institutions and/or financial institution employees,government agencies, bodies, and/or employees, businesses, institutions(e.g., colleges, universities, etc.), and/or private individuals.

In some embodiments, one or more of the components 102, 104, 106 of thesystem 100 may be or include the same device and/or may be componentsand/or portions of the same or similar devices. The risk server 102 may,for example, be included within and/or as a part of a device includingone or more of the user devices 106 a-n. In some embodiments, one ormore of the user devices 106 a-n may be or include and/or otherwise beassociated with one or more of the information source devices 104 a-n.

Referring now to FIG. 2, a block diagram of a system 200 according tosome embodiments is shown. The system 200 may include, according to someembodiments, a risk server 202, one or more information source devices204 a-n, and one or more user devices 206 a-n. In some embodiments, thecomponents 202, 204, 206 of the system 200 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with FIG. 1 above.

In some embodiments, the risk server 202 may include multiple componentssuch as an information gathering engine 210, an information relevancyengine 220, an information redundancy engine 230, a database system 240,an information matching engine 250, and/or an information deliveryengine 260. According to some embodiments, the risk server 202 may notbe included in system 200 and the functionality of the risk server 202may instead be accomplished by one or more components such as thecomponents 210, 220, 230, 240, 250, 260 shown in FIG. 2. In someembodiments, fewer or more components than are shown in FIG. 2 may beincluded in the system 200 and/or the risk server 202.

The information gathering engine 210 may, according to some embodiments,gather information from one or more of the information source devices104 a-n. For example, the information gathering engine 210 may receive,extract, and/or otherwise obtain information from various informationsources such as the information source devices 204 a-n. In someembodiments, the information gathered by the information gatheringengine 210 may generally be indicative of and/or otherwise associatedwith risk. For example, in some embodiments, information gatheringengine 210 is configured to retrieve or receive information from avariety of information source devices 104, where the information sourcedevices 104 are selected based on an assessment that the sources provideinformation that is generally relevant to risk.

According to some embodiments, the information gathering engine 210 mayperform other operations with respect to the gathered information. Forexample, the information gathering engine 210 may aggregate, translate,and/or otherwise manipulate the gathered information as is necessary ordesired for the management of such information. The information may,according to some embodiments, be translated into one or morestandardized formats. For example, the information gathering engine 210may convert any or all gathered information into a standardized digital,eXtensible Markup Language (XML), and/or other format that is or becomesknown. In one current embodiment, the information gathering engine 210performs a coarse tagging of each received item of information, creatinga data packet or document having document tags allowing the packet ordocument to be identified. Further tagging may be performed on datapackets that are determined to include relevant data, as will bedescribed further below.

In some embodiments, the information gathering engine 210 may forward,transmit, send, and/or otherwise provide the gathered information to theinformation relevancy engine 220. In some embodiments, certain items ofinformation or data packets are sent directly from the informationgathering engine 210 to a database system 240 for inclusion in one ormore databases.

In some embodiments, an information relevancy engine 220 may receiveand/or otherwise obtain information from the information gatheringengine 210. In some embodiments, the information may be received in oneor more standardized formats. The information may be received, forexample, in a format that is in accordance with an XML, a Hyper TextMarkup Language (HTML), and/or an eXtensible HTML (XHTML) template.According to some embodiments, the information relevancy engine 220determines whether a data packet includes relevant information.

In some embodiments, the engine 220 assesses or measures an overallrelevancy of the information in a data packet. For example, theinformation relevancy engine 220 may evaluate the information for arelevancy to risk. In some embodiments, information that is not relevant(e.g., the information in a data packet does not relate to risk) may befiltered out and/or deleted or removed. The risk relevant informationcontained within a data packet may also be tagged by the engine 220(e.g., using a markup language or the like). This tagging allows theinformation to be stored in a useful manner in the database system 240.The remaining information that has been deemed to be relevant may then,according to some embodiments, be forwarded, transmitted, and/orotherwise be provided and/or made available to the informationredundancy engine 230.

The information redundancy engine 230 may, in some embodiments, receiveand/or otherwise obtain information (e.g., in the form of tagged orformatted data packets) from the information relevancy engine 220. Theinformation redundancy engine 230 may then, for example, compare thereceived information to stored information to determine if the receivedinformation is redundant. According to some embodiments, the informationredundancy engine 230 may compare the received information toinformation stored within and/or by the database system 240. Informationthat is determined not to be redundant may then be stored, for example,by and/or within the database system 240.

In some embodiments, the information redundancy engine 230 may preventduplication of information within one or more databases (not shown inFIG. 2). For example, the information redundancy engine 230 may comparethe received information to stored information to ensure that onlyinformation that is not already stored in the one or more databases willbe added to the one or more databases (or other information stores). Insome embodiments, the information redundancy engine 230 may includelogic and/or code that perform more complex comparisons between thereceived information and any stored information.

For example, the information redundancy engine 230 may compare thestory, subject, and/or material covered and/or described by both thereceived information and any stored information. In some embodiments, apre-determined number of sources and/or pieces of information relatingto a particular topic may be stored in the one or more databases, whileany further sources and/or pieces of information covering and/orrelating to the same topic may be considered redundant.

The database system 240 may, according to some embodiments, be orinclude one or more databases or other information stores (not shown inFIG. 2). In some embodiments, the database system 240 may storeinformation associated with risk. The database system 240 may receiveand/or store, for example, information received from the informationgathering engine 210, the information relevancy engine 220, and/or theinformation redundancy engine 230. Any databases within and/orassociated with the database system 240 may be or include any typeand/or configuration of databases that are or become known.

In some embodiments for example, a database within the database system240 may include one or more relational data structures. According tosome embodiments, a relational data structure stored in the database ofthe database system 240 may be specially configured to store data in amanner conducive to facilitating the identification of risk. The datastructure may include, for example, tables and relations that associatevarious key risk segments. Risk assessment and/or analysis may,according to some embodiments, utilize the special data structure toquickly, efficiently, and/or accurately identify and/or otherwiseanalyze risk. Various embodiments relating to such a specialized datastructure will be described in subsequent sections of this disclosure(e.g., in conjunction with the description of FIGS. 13-35).

In some embodiments, the information matching engine 250 may performand/or assist in the performance of risk assessment and/or analysisprocedures as describe above in relation to the special data structureof the database system 240. For example, the information matching engine250 may be in communication with one or more of the user devices 206 a-n(e.g., via the information delivery engine 260). The informationmatching engine 250 may, in some embodiments, receive a query (orinformation indicative of a query) from one of the user devices 206.

The information matching engine 250 may then, for example, useinformation in the query to analyze potential risk informationassociated with a particular individual, item, event, organization,and/or other object or entity. In some embodiments, the informationmatching engine 250 may compare the query information to informationstored within and/or by the database system 240. In such a manner, forexample, the query information may be compared to stored information(e.g., that is associated with risk) to determine and/or identify anypotential risk associated with the query information. The informationmatching engine 250 may also perform matching operations to assist inthe retrieval of data from the database. For example, if a query seeksto find information related to a person's name such as John Smith, theinformation matching engine 250 may create additional queries to matchvariants to the person's name (e.g., such as Johnny Smith). Similarly,the information matching engine 250 may assist in ensuring that companynames or other queries are expanded or presented to match a number ofvariants to ensure that a query is as accurate as possible.

In some embodiments, the risk server 202 may include an informationdelivery engine 260. The information delivery engine 260 may, accordingto some embodiments, manage and/or perform the transfer of informationbetween the risk server 202 and the one or more user devices 206 a-n.The information delivery engine 260 may, for example, receive queriesand/or other information from one of the user devices 206 and/or maysend information associated with risk and/or risk assessment informationto the user devices 206. In some embodiments, the information deliveryengine 260 may provide one or more of the user device 206 a-n withdirect access to the information stored within and/or by the databasesystem 240. According to some embodiments, the information deliveryengine 260 may broker information between the user devices 206 and theinformation matching engine 250.

The various components 210, 220, 230, 240, 250, 260 of the risk server202 may, according to some embodiments, be configured in any manner thatis or becomes practicable. For example, any of the components 210, 220,230, 240, 250, 260 may be included within and/or as part of a singledevice (e.g., risk server 202) or multiple devices. In some embodiments,one or more of the components 210, 220, 230, 240, 250, 260 may becombined in one or more other components and/or devices. In someembodiments, the functionality of any or all of the components 210, 220,230, 240, 250, 260 may be performed by a single device (e.g., riskserver 202). According to some embodiments, the risk server 202 and/orany of the components 210, 220, 230, 240, 250, 260 may be associatedwith and/or included within either or both of the information sourcedevices 204 and the user devices 206.

Further, the components 210, 220, 230, 240, 250, 260 and devices 202,204, 206 described herein may, according to some embodiments, be orinclude any number of devices (e.g., network devices), objects,functions, procedures, code, and/or any combination thereof that is orbecomes known. In some embodiments, for example, any or all of thecomponents 210, 220, 230, 240, 250, 260 may be or include a softwareprocedure, module, and/or object that is executed on and/or by the riskserver 202, an information source device 204, a user device 206, and/orany combination thereof.

Referring now to FIG. 3, a method 300 according to some embodiments isshown. In some embodiments, the method 300 is conducted by and/or byutilizing any of the systems 100, 200 described above and/or may beotherwise associated with any of the systems 100, 200 and/or any of thesystem components described in conjunction with any of FIG. 1 and/orFIG. 2 above. The flow diagrams described herein do not necessarilyimply a fixed order to the actions, and embodiments may be performed inany order that is practicable. Note that any of the methods describedherein may be performed by hardware, software (including microcode),firmware, manual means, or any combination thereof. For example, astorage medium may store thereon instructions that when executed by amachine result in performance according to any of the embodimentsdescribed herein.

In some embodiments, the method 300 begins at 302 with the collection ofinformation from a plurality of sources (e.g., from a plurality ofinformation source devices 104, 204). According to some embodiments, thecollecting at 302 is performed by the risk server 102, 202 and/or by theinformation gathering engine 210, as described above. As discussedabove, and as will be discussed further below, information may becollected from a wide variety of information sources.

In some embodiments, processing at 302 is conducted under the control ofthe risk server 102, 202. In some embodiments, processing at 302includes repeatedly retrieving or obtaining information from a selectedlist or set of information sources. For example, an operator controllingor otherwise operating risk server 102, 202 may configure the server toobtain or retrieve information from a list of information sourcesidentified as providing risk relevant information. The informationsources may be, for example, commercial data sources, Internet websites, newspapers, government data sources, etc.

According to some embodiments, the information may be collected on aperiodic basis, as needed or desired, and/or on any other basis that isor becomes practicable. The collecting may include, for example,receiving (e.g., via a scheduled information feed), extracting,gathering, harvesting (e.g., using a software robot or “bot”), and/orotherwise obtaining the information. In some embodiments, processing at302 includes routinely checking data sources to determine if new ormodified information is available, and, if so, retrieving the new ormodified information. In this manner, the risk server 102, 202 mayobtain current information from sources identified as providing relevantinformation.

The method 300 continues at 304, according to some embodiments, bytranslating the information into one or more standardized formats. Thetranslating may be performed, according to some embodiments, by theinformation gathering engine 210 as described above. The informationwhich is collected may include information in a variety of differingformats. In some embodiments, the information (or portions thereof) isconverted into a standardized format and tagged with high-level documenttags allowing the information to be processed further by the risk server102, 202. In some embodiments, the information may not need to betranslated and/or otherwise converted or standardized (e.g., theinformation may have been received in a standardized and/or acceptableformat).

In some embodiments, the method 300 continues by determining a relevancyof each item of information (otherwise referred to herein as a “datapacket” or “document”), at 306. For example, the information relevancyengine 220 may examine each data packet to determine if the informationcontained therein is relevant to risk and/or to the determination ofrisk. In some embodiments, portions of the information may be reviewedand/or analyzed to determine if the contents of the information arelikely to be relevant to risk. According to some embodiments, arelevancy metric, rank, and/or score may be determined for theinformation (and/or portions of the information). Information that isranked or scored lower than a pre-determined threshold may, according tosome embodiments, be filtered, removed, and/or deleted. In someembodiments, two or more filtering steps may be used: an initial orcoarse filtering to remove clearly non-relevant information, and one ormore subsequent filtering steps to identify specific items ofinformation that make an item of information relevant.

The method 300, in some embodiments, continues at 308 by taggingrelevant portions of the information. According to some embodiments, theinformation relevancy engine 220 tags the portions of the informationdetermined to have a relevancy with respect to risk. In someembodiments, only information that is determined to have a relevancythat satisfies a relevancy criterion are tagged. For example, portionsof the information that are determined to have a relevancy score or rankhigher than a pre-determined minimum threshold may be tagged. Thetagging may generally be accomplished via any method and/or procedurethat is or becomes known.

In some embodiments, at 310 the method 300 continues by determining aredundancy of the information. The information redundancy engine 230may, for example, compare the information to stored information todetermine if a newly received data packet includes information that isredundant with previously-received (and stored) information. In someembodiments, the redundancy of the information may be expressed as ametric, rank, score, and/or other value. The redundancy value may, forexample, then be compared to a pre-determined redundancy threshold todetermine whether the information in the newly received data packetshould be added to the database, or be removed or deleted. In someembodiments, a determination may be made whether to update portions ofthe existing data with some or all of the information in the newlyreceived data packet. According to some embodiments, only informationwhich is equivalent to information that is already stored (e.g., indatabase system 240) is filtered or discarded. In some embodiments, onlythe tagged portions of the information are evaluated for redundancy.

The method 300 continues, in some embodiments, at 312 by storing theinformation contained in a newly received data packet in a database. Forexample, the information redundancy engine 230 may cause non-redundantinformation to be inserted into one or more databases. In someembodiments, the information redundancy engine 230 sends the data packetto the database system 240, which then stores the appropriate portionsof the information. According to some embodiments, all receivedinformation that is deemed to be relevant is stored in the databasesystem 240. In some embodiments, only tagged portions of informationand/or only non-redundant portions of information are stored by thedatabase system 240.

In some embodiments, the database system 240 includes a speciallydesigned data structure in which to store the information. For example,the database system 240 may store one or more relational databaseschemas that are configured to facilitate the identification of risk. Insome embodiments, the schemas may be structured to store the informationin a manner that permits easy access to the information and/or allowsrisk-associated relationships to be easily and/or quickly identified.Similarly, in some embodiments, the tagging scheme applied at 308 isselected to include tags based on the database schema.

The method 300 continues at 314, in some embodiments, by providingaccess to the database (e.g., the database system 240) to a user. Forexample, once the database is populated with data from differentinformation sources, the data can be utilized by a variety of users fora variety of different purposes. The information delivery engine 260(and/or the information matching engine 250 or the risk server 102,202), for example, allows a user to access the stored information. Insome embodiments, the user may submit a query (e.g., utilizing a userdevice 106, 206) associated with identifying risk, to the informationdelivery engine 260 (and/or the information matching engine 250 or riskserver 102, 202). The query may then be compared to the storedinformation to identify, quantify, assess, and/or otherwise analyze riskinformation.

In some embodiments, the risk server 102, 202 identifies informationstored in the database system 240 that satisfies and/or is otherwiseassociated with the user's query. The information may be used, forexample, to determine an action that is desirable and/or necessary(e.g., to reduce or avoid risk). According to some embodiments, the riskserver 102, 202 and/or the information delivery engine 260 provides theidentified information and/or the determined action to the user. Therisk server 102, 202 may, for example, be operated to provide arecommended action that the user should undertake (e.g., avoid financialdealings with a certain individual, alert authorities regarding acertain transaction, etc.). In some embodiments, the determined actionmay be automatically undertaken by the risk server 102, 202 and/or oneof the server components 210, 220, 230, 240, 250, 260.

In this manner, embodiments of the present invention may be utilized toobtain unstructured information from a large variety of types ofsources, determine the relevancy of the unstructured information,structure the information according to a tagging scheme, determinewhether the information is redundant or otherwise cumulative withpreviously obtained information, and store the information in a databasein a manner that allows ready retrieval and use. Users of the databasemay use the information to make decisions regarding transactions,relationships, or the like which they were previously unable to assessfrom a risk perspective (particularly from a political, reputational, orregulatory risk perspective).

Information Gathering

Turning now to FIG. 4, a block diagram of a system 400 according to someembodiments is shown. In some embodiments, the system 400 is used toimplement or perform the method 300 and/or may otherwise be associatedwith the method 300 (or any portions thereof) as described inconjunction with FIG. 3 above. The system 400 may, for example, besimilar in configuration and/or functionality to the informationgathering engine 210 (or the risk server 102, 202) and/or may perform inaccordance with the procedures 302, 304 as described above.

In general, the system 400 is operable to control and/or perform thecollection, aggregation and raw conversion of data from a plurality ofinformation sources. The system, for example, allows the systematic andrepeatable collection of source data from a large variety of differenttypes of sources. The system allows the conversion of this source datainto a common format used by the system, allowing further analysis,processing and manipulation of the data.

In some embodiments, the system 400 includes information feed 404 andinformation gathering engine 410. In some embodiments, the informationgathering engine 410 includes an information aggregator 412, a websitemonitoring device 414, a website information extraction device 416,and/or an information translation device 418. The system 400, accordingto some embodiments, also or alternatively includes an informationrelevancy engine 420, a database system 440, and/or an information path480. In some embodiments, the components 404, 410, 420, 440 of system400 are similar in configuration and/or functionality to thesimilarly-named components described in conjunction with any FIG. 1and/or FIG. 2 above.

In some embodiments, the system 400 also or alternatively includes acontrol mechanism and/or control inputs (shown as the informationaggregation manager 412) that allow an operator of the system 400 toconfigure the operation of the system 400. For example, an operator maybe able to configure or define the data to be collected, including thefrequency with which it is to be collected from various sources. Anoperator may also, for example, be able to designate certain informationsources as “pre-qualified” such that the data from those sources neednot be processed using some or all of the components of the system 400(e.g., the data may be passed directly to the information translationdevice 418 and/or may even be directly input to the database system 240of FIG. 2).

In some embodiments, the information feed 404 includes informationreceived from various information sources (e.g., information sourcedevices 104, 204). Information gathering engine 410, for example,collects and/or otherwise obtains information from multiple sources viathe information feed 404 and/or the information path 480. According tosome embodiments, information aggregation manager 412 defines how, andfrom what sources, information is collected.

In some embodiments, such as where the information feed 404 includes oneor more websites, a website monitoring device 414 keeps track of theinformation stored on and/or available from the websites. The websitemonitoring device 414 may, for example, determine when new, changed,and/or updated information is available from any monitored websites. Thedetermination of new, changed, and/or updated information may then,according to some embodiments, be forwarded and/or otherwise provided toeither or both of the information aggregation manager 412 and thewebsite information extraction device 416. In some embodiments, thewebsite monitoring device 414 may run or control a script associatedwith each website to be monitored. Each script defines how it'sassociated website is to be monitored in order to determine whetherinformation on the website has been updated or otherwise changed. Forexample, in some embodiments, each time a website is monitored, a hashcode is generated for each page on the website, where the hash code is anumeric representation of the information on the page. If a page isupdated to change even a single word, the hash code will change and thewebsite monitoring script will indicate that the website has changed.

When a monitored website has changed or is known to include new orupdated information, a website extraction device 416 is operated toextract information from the website (or other information source). Forexample, the website information extraction device 416 may receive anindication from the website monitoring device 414 and/or from theinformation aggregation manager 412 that new, changed, and/or updatedinformation is available at a particular website or group of websites.

Each website that is monitored by the system may have a separateextraction script associated with it. In one specific embodiment,extraction scripts may be coded using any of a number of so-called“visual web tank” (VWT) tools that assist in the creation of executablespiders for download and extraction tasks. For example, the tool may beconfigured to navigate to a monitored website, and is instructed tofollow certain links to a desired page. The tool is configured to findparticular areas on the desired page that include relevant or desiredinformation. For example, the tool may be used to monitor the FBI's topten most wanted list by causing the tool to navigate to:http://www.fbi.gov/mostwant/topten/fugitives/fugitives.htm The tool mayalso be configured to extract each picture on the overview page, andthen navigate thru the link associated with each picture to the pagecontaining detailed information about each fugitive. The tool thencollects the information from each page and outputs the information as aformatted data packet for further processing by the system.

In some embodiments, the efficiency and accuracy of the extraction andmonitoring scripts are dependent on each site's formatting. When asite's format changes (e.g., if the FBI's Top Ten list were moved orbroken into different pages), the efficiency and accuracy of theextracted data may drop. To identify such changes, each batch or groupof extracted data is analyzed to identify changes in output quality. Forexample, if a site normally has a high output of data, but the outputsuddenly drops, the site may be flagged for further inspection (e.g., bya system operator).

The website information extraction device 416 may receive, for example,a list and/or feed including one or more Uniform Resource Locator (URL)addresses that are associated with desired information. A systemoperator, for example, may specify the list such that the engine 410maintains a current list of websites that are to be monitored and/orfrom which information is to be extracted. In some embodiments, websitesmay be added or removed from the list as is necessary and/or desired toeffectuate the extraction of the desired types and/or quantities ofinformation.

In some embodiments, the website information extraction device 416 maybe or include a software program, module, and/or package which may form,for example, a software “bot” or other harvesting or downloadingprocedure. The website information extraction device 416 may also oralternatively be configured to extract information from designatedwebsites or information sources on a scheduled basis. According to someembodiments, the website information extraction device 416 forwards anyextracted information to the information translation device 418 for anyrequired and/or desired formatting, conversion, and/or standardization.

In some embodiments, the information translation device 418 receivesinformation from either or both of the information aggregation manager412 and the website information extraction device 416. According to someembodiments, the information translation device 418 converts and/ortranslates received information into one or more standardized formats.For example, the information translation device 418 may receive varioustypes of information (e.g., website information, news articles, watchlists, regulatory documents, etc.) and convert each of the various typesof information into an XML format.

In some embodiments, received information may already be configured inan acceptable standardized format and may not require translation (e.g.,for sources designated as “pre-qualified”). The information translationdevice 418 may, according to some embodiments, also or alternativelytranslate the received information from one or more languages, codes,and/or other types of formats, into one or more desirable and/or usefulformats, languages, and/or configurations. The information translationdevice 418 may, according to some embodiments, be or include anencryption device for encrypting and/or decrypting the informationand/or may also or alternatively compress, decompress, and/or otherwisetranslate the information.

According to some embodiments, the information translation device 418forwards and/or otherwise provides the standardized information toeither or both of the information redundancy engine 420 and the databasesystem 440. Information that originated from a commercial informationsource, for example, may be pre-formatted and/or standardized, and/ormay be pre-determined to be relevant (e.g., per-determined to beassociated with risk), and thus may be sent directly to the databasesystem 440 for storage.

For example, certain pre-determined types and/or pieces of informationmay be purchased from a commercial source. In other words, informationmay, according to some embodiments, not be purchased unless it ispre-determined to be relevant for one or more desired purposes. This“pre-qualified”, pre-formatted and/or specially selected information is,according to some embodiments, sent by the information translationdevice 418 directly to the database system 440 for storage (e.g., in adatabase). Other public websites may also be designated as“pre-qualified”. For example, a system operator may determine that theFBI's most wanted list is always considered to be relevant information.Information extracted from this website may, thus, be forwarded directlyto the database system 440 for storage. Other information, such asinformation extracted from websites and other sources may be forwardedto the information relevancy engine 420 to determine if the informationis relevant.

Referring now to FIG. 5, a method 500 according to some embodiments isshown. In some embodiments, the method 500 is conducted by and/or byutilizing any of the systems 100, 200, 400 described above and/or isotherwise associated with any of the systems 100, 200, 400 and/or any ofthe system components (e.g., the information gathering engine 210, 410)described in conjunction with any of FIG. 1, FIG. 2, and/or FIG. 4above. In some embodiments, the method 500 is or includes a portion ofand/or a procedure within other methods such as method 300 describedabove.

In some embodiments, the method 500 begins at 502 by identifying one ormore websites that contain (or are believed to contain) relevantinformation. The website monitoring device 414 may, for example,determine whether one or more monitored websites (e.g., websites on alist of websites to be monitored) include new, changed, updated, and/orother information that may be of interest. In some embodiments, theInternet may be searched for websites that may include and/or mayotherwise be associated with relevant information (e.g., informationassociated with risk). In some embodiments, a website on a list ofwebsites to be monitored may be evaluated to determine if the websiteshould remain on the list. Websites that have not been updated for longperiods of time, for example, may be dropped from the list. Otherwebsites may also or alternatively be added to the list when adetermination is made that the website may contain desirable and/oruseful information (e.g., information associated with risk).

The method 500 continues, according to some embodiments, by extractingthe information from the one or more websites, at 504. For example, thewebsite information extraction device 416 may utilize informationassociated with the identified one or more websites (e.g., a URL) tolocate the one or more websites and extract the information. In someembodiments, the information available at an identified website may besearched, analyzed, and/or otherwise examined to determine whichportions of available information are desired. According to someembodiments, all of the information provided by an identified websitemay be extracted.

At 506, the method 500, according to some embodiments, includesreceiving information from a plurality of sources. The receiving at 506may include, for example, receiving the information extracted at 504. Insome embodiments, other information may also or alternatively bereceived. For example, information may be collected by the informationgathering engine 210, 410 from a plurality of information source devices104, 204 and/or information feeds 404. In some embodiments, any or allof the information may be received via a scheduled and/or otherwisepre-arranged feed. For example, a commercial or governmental informationsource may be contracted to deliver certain types of information (e.g.,on a periodic basis, as new information becomes available, etc.).

According to some embodiments, the method 500 continues at 508 byaggregating the information. The information aggregation manager 412(and/or the information gathering engine 210, 410) may, for example,combine the information received from the plurality of sources into oneor more data packets, packages, feeds, and/or groups. In someembodiments, the information from the various sources may be combinedand/or grouped according to various factors. The information may begrouped, for example, based upon the type of information source, thequality and/or reliability of the information source, and/or may bebased upon the information type, format, and/or content.

In some embodiments, the method 500 continues by translating theinformation into one or more standardized formats, at 510. For example,the information translation device 418 (and/or the information gatheringengine 210, 410) converts and/or otherwise transforms the informationinto various formats. In some embodiments, only portions of theinformation may require translation. Translation may include, forexample, translating information from one language to another,converting the information from one format to another, organizing theinformation into one or more formats and/or templates, and/or otherwiseconverting, standardizing, decoding, decrypting, decompressing, and/ormanipulating the information.

FIG. 6 shows a block diagram of a system 600 according to someembodiments. In some embodiments, the system 600 is used to implement orperform and/or may otherwise be associated with the methods 300, 500 (orany portions thereof) as described in conjunction with any of FIG. 3and/or FIG. 5 above. The system 600, according to some embodiments, issimilar in configuration and/or functionality to the system 400described above.

According to some embodiments, the system 600 includes multipleinformation feeds 604 a-d and an information gathering engine 610. Theinformation gathering engine 610 includes, for example, an informationaggregation manager 612, a website monitoring device 614, a websiteinformation extraction device 616, and an information translation device618. In some embodiments, the system 600 also or alternatively includesan information relevancy engine 620 and/or a database system 640. Insome embodiments, the components 604, 610, 620, 640 of system 600 may besimilar in configuration and/or functionality to the similarly-namedcomponents described in conjunction with any of FIG. 1, FIG. 2, and/orFIG. 4 above.

In some embodiments, the various information feeds 604 a-d correspond toand/or otherwise are associated with various information source devices104, 204. According to some embodiments, various types of informationare received from the information feeds 604 and/or the informationreceived from the information feeds 604 are treated and/or handleddifferently within system 600 and/or within the information gatheringdevice 610.

For example, the information feed 604 a may provide information from anews source such as a newspaper or broadcast network. The informationmay be or include, for example, a news article describing the results ofa political election. In some such embodiments, the information may bereceived by the information aggregation manager 612 of the informationgathering engine 610 via an information path 680 a. In some embodiments,the information from the information feed 604 a is aggregated and/orotherwise processed by the information aggregation manager 612 (e.g.,combined and/or grouped with other news articles covering the sameelection). The information may then, for example, continue along theinformation path 680 a to the information translation device 618. Insome embodiments, the information translation device 618 operates totranslate received information into a common format so that it may bepassed to the information relevancy engine 620 and/or the databasesystem 640 for further processing. In some embodiments, the informationtranslation device 618 may further perform preliminary or coarse taggingof information to facilitate further processing. For example, theinformation translation device 618 may insert tags that define thebeginning and the end of the document, the title, and other basicdocument information (if readily discernable). According to someembodiments, the article may also or alternatively be converted into astandardized format such as may be defined by an XML template. In someembodiments, the article (now contained in a standardized data packet)continues along the information path 680 a to the information relevancyengine 620, where, for example, the relevancy of the article (e.g., withrespect to risk) is determined.

In some embodiments, the information feed 604 b provides informationfrom a monitored website. For example, the information feed 604 b may beassociated with a website such as a terrorist watch group website thatposts information relating to suspected terrorists. Such information is,for example, directed along the information path 680 b to theinformation aggregation manager 612. The information aggregation manager612, for example, sends the information along the information path 680 bthrough the website monitoring device 614 and to the website extractiondevice 616. In some embodiments, the information may be sent along theinformation path 680 b-1 directly from the information source device 604b to the website monitoring device 614. According to some embodiments,the information may be sent and/or retrieved directly from theinformation source device 604 b to the website information extractiondevice 616 (e.g., via the information path 680 b-2). The website ismonitored, for example, by the website monitoring device 614, which maydirect the website information extraction device 616 to retrieve theinformation from the website when changes or updates in the website aredetected.

In some embodiments, the website information is sent further along theinformation path 680 b to the information translation device 618. Theinformation translation device 618, according to some embodiments,performs various transformations on the website information (e.g., suchas the translations, conversions, and tagging described above andelsewhere herein). In some embodiments, the information is then bedirected further along the information path 680 b to the informationrelevancy engine 620, where, for example, the relevancy of the websiteinformation (e.g., with respect to risk) is determined.

According to some embodiments, the information feed 604 c providesinformation from one or more websites. The information may include, forexample, information from a website that provides important information(or information having known relevance) on a regular basis (e.g., via asubscription). The website may include, for example, a website operatedby the Jane's™ Information Group that provides security and otherintelligence information. In some embodiments, the information (such assecurity intelligence information) may be received by the informationaggregation manager 612 via the information path 680 c. According tosome embodiments, the information is extracted from the Jane's™ websiteusing the website information extraction device 616. In otherembodiments, the information may be provided by Jane's™ directly (e.g.,via a scheduled data export or download).

As another example, the information feed 604 c, according to someembodiments, provides information from an entity engaged in thecollection of data from hardcopy and other sources. For example, anentity may be engaged to obtain and collect information from a varietyof sources such as municipalities or other entities by scanning,entering data, and/or otherwise processing information. As a specificexample, a service provider may be engaged to scan and enter data fromimmigration records and visa applications which are otherwiseunavailable in electronic form. The information source (e.g., in thisexample, a service provider that scans and enters the data) may, forexample, provide the information via an information feed (such as theinformation feed 604 c) and/or may process the information as describedabove.

In some embodiments, the information received is sent along theinformation path 680 c to the information translation device 618. Theinformation translation device 618, according to some embodiments,performs various transformations on the information (e.g., such as thetranslations, conversions, and tagging described above and elsewhereherein). In some embodiments, the information is then be directedfurther along the information path 680 c to the information relevancyengine 620, where, for example, the relevancy of the information (e.g.,with respect to risk) is determined.

In some embodiments, information is received from a “pre-qualified”information source, and/or an information source that is known tocontain risk relevant information in a desired or otherwise knownformat. In such embodiments, the information is sent directly from theinformation aggregation manager 612 to the information relevancy engine620 (path not shown in FIG. 6). In some embodiments, whether theinformation requires processing or not, it may be known that theinformation provided by is relevant and/or non-redundant. Theinformation is then, for example, sent directly from the informationgathering engine 610 (e.g., via the information path 680 d) to thedatabase system 640 for storage.

As a specific illustrative example, an operator of the system 600 maydesignate the OFAC list published by the U.S. Department of Treasury tobe a “pre-qualified” source having information deemed to be riskrelevant, non-redundant, and/or provided in a known format. Each timethe OFAC list is updated, the list is received by the informationgathering engine 610 and processed along path 680 d, for example. Otherinformation sources may also be treated in a similar manner. In general,embodiments allow different information sources to be treateddifferently, depending on the nature of the data. Sources known tocontain risk relevant data in a known format can be, for example,readily processed and transmitted to database system 640.

In some embodiments, the information from such an information source mayrequire further processing and/or translation and the information may besent along the information path 680 d to the information translationdevice 618. The information translation device 618, according to someembodiments, performs various transformations on the website information(e.g., such as the translations, conversions, and tagging describedabove and elsewhere herein). For example, in some embodiments, the OFAClist may require formatting, tagging, and/or other processes that may beperformed by the information translation device 618.

The exemplary information types and sources described above are providedfor illustrative purposes only. Other variations of information typesand/or sources may be incorporated into some embodiments. Theinformation paths 680 are also described in an illustrative manner. Forexample, a news article (e.g., information feed 604 a) can be sentdirectly to the database system 640 for storage without being processedby the information translation device 618. Similarly, websiteinformation (e.g., information feeds 604 b, 604 c) may not require awebsite information extraction device 616 and/or may also oralternatively be sent directly to the database system 640. Anyinformation sources, types, and/or paths that are or become desirableand/or useful may be utilized to practice some embodiments.

Relevancy Engine

Turning now to FIG. 7, a block diagram of a system 700 according to someembodiments is shown. In some embodiments, the system 700 is used toimplement or perform the methods 300, 500 and/or may otherwise beassociated with the methods 300, 500 (or any portions thereof) asdescribed in conjunction with any of FIG. 3 and/or FIG. 5 above. Thesystem 700 may, for example, be similar in configuration and/orfunctionality to the information relevancy engine 220, 420, 620 (or therisk server 102, 202) and/or may perform in accordance with theprocedures 306, 308 as described above.

The system 700 includes an information relevancy engine 720 that isconfigured and operable to receive data from information feed 780,filter non-relevant data out of the information feed, tag the relevantdata, and output the tagged data for further processing. Features ofsome embodiments of an information relevancy engine 720 will bedescribed in conjunction with an illustrative example. In theillustrative example, a number of data packets have been collected frominformation sources (e.g., by the information gathering engine 410described above). As discussed above, each of the information sourcesare selected as generally providing risk-relevant information. However,because there may be a huge amount of information gathered from thesources, not all of the information may actually be relevant to risk.

Embodiments allow the configuration and operation of relevancy engine720 to filter out information that is deemed to include non-relevantdata. As will be described, the operator of the relevancy engine canconfigure and adapt the engine to vary the type of information that isconsidered to be risk relevant (for example, a system operated on behalfof a governmental entity may put less emphasis on risk associated withfinancial transactions than a system operated on behalf of a financialinstitution).

In the illustrative example, the operator of the system has determinedthat information associated with the term “fugitive” is generallyrelevant. Further, the operator has specified that documents or packetsof data that include the term “fugitive” must be used in conjunctionwith one or more associated terms that tend to indicate that the term isused in a manner of interest. As a specific example, the operator hasspecified that the term “fugitive” is risk-relevant if it is used inconjunction with a person's name, a place, and/or one or more verbs(such as “flight”, “flee” or “escape”). The system operator may define anumber of such terms and relationships to identify data that itconsiders to be relevant. The set of terms may be updated as needed.

In the illustrative example, two data packets of information areprovided to information relevancy engine: a first data packet retrievedfrom a money laundering website discussing a fugitive named John Smithwho fled the United States to seek refuge in Mexico, and a second datapacket retrieved from the same money laundering website which simplyincludes a dictionary definition of the term “fugitive” (i.e., definingthe term as: “Running away or fleeing, as from the law”). Of course, inoperation, many other data packets may be received and processed by theinformation relevancy engine.

Referring again to FIG. 7, in some embodiments, the informationrelevancy engine 720 includes a pre-tag information filtering device722, an information tagging device 724, and/or a post-tag informationfiltering device 726. The system 700 may, according to some embodiments,also or alternatively include an information redundancy engine 730, aninformation feed 780, and/or an information path 782. In someembodiments, the components 720, 730 of system 700 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with any of FIG. 1, FIG. 2, FIG. 4, and/or FIG.6 above.

In some embodiments, some or all of the system 700 may be implementedusing commercially-available software configured to perform informationtagging. As a specific example, the ClearTags® intelligent taggingengine offered by ClearForest, Inc.® of New York, N.Y. may be used toapply tags to information received via information feed 780 pursuant torules established by an operator of the information relevancy engine720. Other custom or commercial software may also or alternatively beused without deviating from some embodiments.

In some embodiments, the information feed 780 may be or includeinformation received from the information gathering device 210, 410,610. The information feed 780 may include and/or be fed by, for example,the information path 480, 680 from the systems 400, 600 described above.In some embodiments, the information feed 780 may be or includeinformation from other sources. According to some embodiments, theinformation feed 780 may provide information to the pre-tag filteringdevice 722 (and/or to the information relevancy engine 720) via theinformation path 782.

The information may also or alternatively be received in one or morestandardized formats (e.g., as described herein) and/or may include tagsidentifying certain information types. For example, the informationreceived via the information path 782 may be formatted as packets oritems of data representing a single document or item of informationretrieved by, for example, the information gathering device 210, 410,610. Each packet or item of data may be formatted using coarse documenttags (e.g., which identify the start and end of the document, and mayalso identify the source, date or a other essential characteristics ofthe packet or item of data).

In some embodiments, the pre-tag filtering device 722 is configured andoperated to filter each of the data packets provided by information feed780. In some embodiments, each data packet is filtered by identifyingthe presence or absence of predetermined keywords or phrases selected asindicators of risk-relevant information. According to some embodiments,the filtering may be based on a relevancy score or determination (e.g.,based on the presence or lack of identified keywords, phrases orcollections of keywords). The pre-tag filtering device 722 may, forexample, remove, delete, and/or otherwise discard any data packets (or,in some embodiments, portions of data packets) that are determined notto include risk relevant information. In some embodiments, logic may beincluded within the pre-tag filtering device 722, for example, thatidentifies unwanted and/or unnecessary information.

Continuing the illustrative example introduced above, a system operatormay configure the system to search for a number of keywords, includingthe keyword “fugitive”. Pre-tag information filtering device 722 may, inthe example, perform keyword searches against each incoming data packetto identify whether the data packet includes the term “fugitive.” Insome embodiments, the system may be configured to search forpredetermined keyword densities. For example, if the term “fugitive” isused only once in a data packet including 10,000 words, the data packetmay be deemed non-relevant (unless some other term or terms are presentin sufficient density). If the term “fugitive” is used ten times in adocument containing one-hundred words, the data packet may be initiallydeemed to be relevant (although other associated terms may also berequired as will be discussed below). By modifying and updating keywordand keyword density information, a system operator can respond tochanged circumstances and can improve the accuracy of informationfiltering, thereby obtaining highly relevant data for furtherprocessing. In some embodiments, the pre-tag information filteringdevice 722 is not the final determination of relevancy, instead, it is acoarse or initial screen for relevancy. A data packet that is deemedinitially relevant by the device 722 may still be determined to benon-relevant by later processing to be described further below.

In the illustrative embodiment, two different data packets are receivedfor analysis. Both data packets contain a key word searched by thesystem. For illustration, assume that both data packets contain it insufficient density to pass the initial relevancy query.

Those data packets that pass the filtering of filtering device 722 areprocessed further by the information tagging device 724 which receivesthe filtered information from the pre-tag information filtering device722. In some embodiments, the tagging device 724 operates to bothidentify information and tag the information in the data packets. Insome embodiments, the tagging device 724 again searches each data packetfor the presence of keywords that are deemed to be relevant to risk. Forexample, the term “fugitive” may again be searched for. If keywords arefound, they are tagged so that they may be used in further processing.The tagging may involve, for example, inserting tags (e.g., XML tags)into the information.

Other information associated with keywords may also be searched for andtagged. For example, the term “fugitive” may be associated with one ormore associated terms that have been determined to be present inrelevant data packets. In the example, if the term “fugitive” is presentin a data packet, associated terms such as “flight”, or “escape” mustalso be present for the data packet to be relevant. Other associatedterms may also need to be present, such as a relationship of the term toa person, an organization or a place. In the example, the data packetabout “John Smith” may be analyzed to identify that the key word“fugitive” is present, along with an associated action term (“fled”) anda relationship to a person (“John Smith”) and a place (“the UnitedStates” and “Mexico”), indicating that the data packet is relevant. Eachof the terms may be tagged for further processing. In the example, thedata packet including the dictionary definition may fail processing bythe information tagging device 724 because, although it contains thekeyword “fugitive” and an action term “running away” or “fleeing”, itlacks a relationship term (there is no person, place or organizationrelated to the keyword). This data packet may be determined to benon-relevant and not tagged by the information tagging device 724.

In some embodiments for example, the tagging device 724 may identifyrelevant information and may tag the information with one or moreappropriate tags. In some embodiments, the tagging device 724 maydetermine a relevancy score, rank, metric, and/or other value associatedwith relevancy. According to some embodiments, the information may betagged to identify and/or associate the relevancy metric with theinformation. Other codes, identifiers, and/or other information may alsoor alternatively be associated with tags that are assigned to and/orinserted within the information.

According to some embodiments, the tagged data packet is received by thepost-tag information filtering device 726. In some embodiments forexample, the post-tag information filtering device 726 may perform asecond filtration of the information. Information that is relevant(e.g., that passed the first filter by the pre-tag filtering device 722)but that has a relevancy score or metric that falls below a certainthreshold, for example, may be removed, deleted, and/or otherwisediscarded by the post-tag information filtering device 726.

In some embodiments, the post-tag information filtering device 726 mayfilter the information based on other criteria. According to someembodiments, the post-tag information filtering device 726 may not beincluded in system 700 and/or within the information relevancy engine720 (e.g., the second filtration of information may not be requiredand/or desired). In some embodiments, the post-tag information filteringdevice 726 performs a final tagging of the data packet to facilitatefurther processing. As an example, post-tag information filtering device726 may include functionality provided by the ClearTags engine discussedabove. Tagged data packets are then forwarded to the informationredundancy engine 730 to determine if the information is redundant(e.g., with respect to information already stored and/or acquired).

Referring now to FIG. 8, a method 800 according to some embodiments isshown. In some embodiments, the method 800 may be conducted by and/or byutilizing any of the systems 100, 200, 400, 600, 700 described aboveand/or may be otherwise associated with any of the systems 100, 200,400, 600, 700 and/or any of the system components (e.g., the informationrelevancy engine 220, 420, 620, 720) described in conjunction with anyof FIG. 1, FIG. 2, FIG. 4, FIG. 6, and/or FIG. 7 above. In someembodiments, the method 800 may be or include a portion of and/or aprocedure within other methods such as method 300 described above.

In some embodiments, the method 800 begins at 802 by receivingstandardized information. For example, the information relevancy engine720 receives the standardized information or formatted data packets froman information feed 780. In some embodiments, the information isreceived in a standardized format (e.g., as applied by the informationtranslation device 618 of the information gathering engine 610). As aspecific example, the information may be received in an HTML format orin a document template (such as a Microsoft Word® template). Accordingto some embodiments, the standardized format may include tagged portionswithin the information (e.g., corresponding to certain informationtypes, sources, content, and/or to information associated with relevancyand/or risk).

The method 800 continues at 804, for example, by identifying informationassociated with risk. For example, the information may be analyzedand/or examined to determine if any portions of the information arerelevant to risk. In some embodiments, this may involve identifyingcertain keywords, phrases and/or concepts within the information. As aspecific example, a data packet that includes the term “fugitive” may(at least initially) determined to be risk relevant. In someembodiments, the mere presence of a term or keyword may not cause thedata packet to be classified as relevant; rather, the term or keywordmay need to be present in a predetermined density within the data packetfor the packet to be classified as relevant. These lists of keywords,phrases or other data may be stored in a database and/or updated asappropriate. Natural language processing techniques may further be usedto identify the presence of risk-relevant information. In someembodiments, the pre-tag information filtering device 722 may performand/or otherwise be associated with the identification of theinformation associated with risk. In general, processing at 804 isadapted to identify data packets that do not contain risk relevantinformation so that such non-relevant data packets may be eliminatedfrom further processing.

In some embodiments, the method 800 continues by filtering theinformation, at 806. The pre-tag information filtering device 722 may,for example, filter the information based on one or more criteria and/orguidelines. In some embodiments, the data packets that were identifiedas lacking risk-relevant information in step 804 are filtered from thesystem. For example, non-relevant data packets (or portions thereof) maybe removed, deleted, and/or otherwise discarded. In some embodiments,the information filtered out may be set aside for further review and/ormay be stored for later use, review, and/or analysis.

The method 800 may continue at 808, according to some embodiments, byperforming further analyses on the data packets that remain (i.e., thedata packets that passed the initial filtering process). Pursuant tosome embodiments, processing at 808 may include the performance offurther keyword searches to identify the presence of known risk-relatedkeywords. Further, processing at 808 may include natural languageprocessing to identify one or more associated terms or relationshipsrelated to identified keywords. These relationships and associated termsmay be maintained in a database or other datastore, and updated asneeded as circumstances change or as needed to improve the accuracy ofthe system. As discussed in the illustrative example introduced above,the keyword “fugitive” may be associated with one or more action terms(such as “flight” or “escape”) and one or more relationships (such as arelationship to a person, place, or organization). Processing at 808 isadapted to identify the presence of these keywords and associated termsand relationships.

Processing continues at 810 where a relevancy of the information isdetermined and further filtering is performed. In some embodiments,processing at 810 includes determining whether a data packet includessufficient keywords and their associated terms and relationships to beconsidered relevant. For example, each keyword may have an associatedpredicate that defines the associated terms or relationships that mustexist within a document for the document to be considered relevant. Inthe example, introduced above, the article regarding John Smith thefugitive may be considered relevant because it contains a keyword(“fugitive”), a necessary relationship (a “person” and a “place”), andan action term (“fled”), while the dictionary definition would not beconsidered relevant because although it contains a keyword and an actionterm, it does not contain a necessary relationship.

Processing at 810 may include analyzing predicate information for eachidentified keyword to determine whether the data packet should beconsidered relevant. If a document is deemed to be non-relevant, it maybe deleted or flagged for further analysis. In general, processing at810 is adapted to apply a more rigorous analysis of data in data packetsthat were initially screened or identified as containing relevantinformation at step 806. Further, processing at 810 identifies terms andphrases within each data packet that are relevant to an analysis ofrisk, allowing them to be tagged at 812.

Processing at 812 includes tagging portions of data packets based on theanalysis performed at 810. In some embodiments, only data packets deemedto be relevant are tagged. Pursuant to some embodiments, a commercialtagging system may be used to accurately and efficiently tag each datapacket. In some embodiments, data packets are tagged using HTML or XMLtagging schemes. In some embodiments, each item of informationidentified and utilized in the analysis at 808 and 810 are tagged (e.g.,identified keywords are tagged, identified relationships are tagged,identified action terms or associated terms are tagged, etc.). Theresult is a tagged data packet that is deemed to include risk-relevantdata, and that has the risk-relevant terms tagged. The article aboutJohn Smith, for example, may include tags identifying John Smith as aname, the United States and Mexico as related places, etc. These tags,as will be discussed further below, allow the data to be readily storedin a database for further analysis and use.

In some embodiments, the process may also include arriving at an overalland/or total relevancy for an item of information or packet of data. Insome embodiments, any relevancy scores or metrics determined forportions of the information may be added, averaged, and/or otherwiseprocessed to determine a relevancy for the entire item of information(i.e., the item of information that is comprised of and/or associatedwith the various portions). In some embodiments, the relevancy of theinformation may be determined based upon the most relevant portionwithin the item of information. According to some embodiments,information may simply be determined to either be relevant or notrelevant. More stringent relevancy criteria than may have been used inprevious procedures may, for example, be applied to the information on apass or fail basis.

For example, information falling below a certain relevancy value may bediscarded, while information having relevancy greater than or equal tothe value may be stored and/or otherwise maintained by the system (e.g.,system 100, 200, 400, 600, 700). According to some embodiments,different ranges and/or groups of relevant information may be stored indifferent databases, areas of a database, and/or may otherwise bemaintained in a fashion indicative of the various associatedrelevancies. In some embodiments, any information identified for removal(e.g., information that is not relevant enough) may be checked, scanned,analyzed, and/or otherwise examined to verify that the informationshould be discarded. In some embodiments, even the information that isidentified for filtering out may be stored and/or maintained (e.g., inan audit log, data repository, and/or other data storage area).

Turning now to FIG. 9, a block diagram of a system 900 according to someembodiments is shown. In some embodiments, the system 900 may be used toimplement or perform and/or may otherwise be associated with the methods300, 500, 800 (or any portions thereof) as described in conjunction withany of FIG. 3, FIG. 5, and/or FIG. 8 above. The system 900 may,according to some embodiments, be similar in configuration and/orfunctionality to the system 700 described above.

The system 900 may, for example, include an information relevancy engine920. In some embodiments, the information relevancy engine 920 mayinclude a pre-tag information filtering device 922, an informationtagging device 924, a post-tag information filtering device 926, and/oran information review device 928. The system 900 may, according to someembodiments, also or alternatively include an information redundancyengine 930, an information feed 980, and/or an information path 982. Insome embodiments, the components 920, 930 of system 900 may be similarin configuration and/or functionality to the similarly-named componentsdescribed in conjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6,and/or FIG. 7 above.

In some embodiments, the information feed 980 provides data packets orother documents to the relevancy engine. In general, the data packetsare retrieved from sources (e.g., such as websites) that are selected ashaving relevant information. However, not all information from thesesources may be relevant, and the relevancy engine allows the filteringand analysis of the data to remove non-relevant information. In theexample introduced above, information feed 980 may provide data packetsincluding a data packet containing an article about the fugitive JohnSmith, and another data packet containing a dictionary definition of theterm “fugitive”.

In some embodiments, the pre-tag information filtering device 922 mayanalyze the data packets and filter out any data packets that are mostclearly not relevant. For example, the pre-tag information filteringdevice 922 may apply a number of keyword searches to identify thepresence of identified risk-related keywords in each data packet. Thesekeywords may be maintained in one or more databases (not shown)associated with the information relevancy engine 920. Each keyword mayalso be associated with information specifying density requirements thatmust be met for a document or data packet to be deemed relevant.

According to some embodiments, the filtered data packets continue alongthe information path 982 a to the information tagging device 924. Insome embodiments, the filtered and/or removed information (e.g.,non-relevant data packets) may be sent along an information path 982 bto the information review device 928. The removed information may then,for example, be examined and/or analyzed to verify that the informationlacks relevancy.

In some embodiments, the removed information may be checked by anoperator utilizing the information review device 928. According to someembodiments, the removed information may be automatically compared tovarious secondary lists and/or sources, and/or may be otherwise furtherexamined to verify lack of relevancy. If the removed information isdetermined to have relevancy, than the removed information may bere-joined with the data packets by being transmitted along theinformation path 982 b to the information tagging device 924.Verification of lack of relevancy may, according to some embodiments,cause the removed information to be deleted and/or otherwise discarded.

The information tagging device 924 may, in some embodiments, identifyand tag certain items of data in each data packet that passes theinitial filtering. For example, the information tagging device 924 mayhave access to the data store of keywords and may again search toidentify the presence of keywords in the data packet. Further, thedevice may also have access to sets of defined predicates associatedwith each keyword and may search each data packet for the presence ofthis predicate information. Each located keyword and associated term maybe tagged using, for example, HTML, XML or other tagging schemes. Forexample, a person's name located within a document or data packet may betagged with any number of appropriate “name” identification tags.Similarly, any other potentially important information included in thedata packet (e.g., dates, places, account numbers, monetary values,etc.) may be tagged.

In some embodiments, the information tagging device 924 may determine arelevancy of information contained within each data packet. For example,a data packet including the article about John Smith may be deemedrelevant because the article includes a keyword as well as predicateinformation associated with the keyword. As another example, the datapacket including the dictionary definition of “fugitive” may be deemedto be non-relevant because the definition does not required predicateinformation associated with the keyword. In some embodiments, the devicemay further assign a relevancy score to information.

In some embodiments, any information returned from the informationreview device 928 (e.g., along the information path 982 b) may also oralternatively be tagged. The returned information may, according to someembodiments, be re-joined, re-inserted, and/or otherwise combined withdata packets deemed relevant by processing at devices 922 and 924. Insome embodiments, the tagged and/or re-compiled information may then besent along the information path 982 c to the post-tag informationfiltering device 926. The post-tag information filtering device 926 may,in some embodiments, filter the list based on the various relevancies(e.g., relevancy scores) determined by the information tagging device924.

The post-tag information filtering device 926 may, for example, comparethe relevancy of each portion of the list to a minimum relevancycriterion. In some embodiments, those portions of information (and/orassociated information) that are determined to have relevancies that aretoo low (e.g., below the minimum criterion) may be filtered out. In someembodiments, the various relevancies associated with portions of a datapacket may be added, averaged, and/or otherwise manipulated to determinea total relevancy for the entire data packet. According to someembodiments, if the total relevancy is below a pre-determined value,than the entire data packet may be deleted and/or removed. Any portionsof the data packet that are determined to have an acceptable relevancy(e.g., the entire data packet, some portion of the data packet, etc.)may then, according to some embodiments, be sent along the informationpath 982 c to the information redundancy device 930. In someembodiments, the information redundancy device 930 may determine aredundancy associated with the data packet and/or portions of the datapacket.

In some embodiments, any information that is filtered out and/orotherwise removed or determined not to be relevant, may be sent alongthe information path 982 d to the information review device 928. Theinformation review device 928 may, according to some embodiments,analyze the removed information to verify that removal is appropriate.If a data packet is removed to the information review device 928, forexample, a reviewer and/or a verification program may examine the datapacket to ensure that no important, potentially important, and/orotherwise relevant information resides within the data packet. If thedata packet (or portions thereof) is determined to be relevant and/or isdetermined to have been improperly removed, then the data packet may besent, for example, along the information path 982 d to the informationredundancy device 930 (e.g., to be re-joined with other relevant datapackets and/or with other associated information, etc.).

Redundancy Engine

Referring now to FIG. 10, a block diagram of a system 1000 according tosome embodiments is shown. In some embodiments, the system 1000 is usedto implement or perform any of the methods 300, 500, 800 and/or mayotherwise be associated with any of the methods 300, 500, 800 (or anyportions thereof) as described in conjunction with any of FIG. 3, FIG.5, and/or FIG. 8 above. The system 1000, for example, is similar inconfiguration and/or functionality to the information redundancy engine230, 730, 930 (or the risk server 102, 202) and/or may perform inaccordance with the procedures 310, 312 as described in conjunction withFIG. 3.

The system 1000, for example, includes an information redundancy engine1030. In some embodiments, the information redundancy engine 1030includes an information comparison device 1032, an informationextraction device 1034, and/or an information insertion device 1036. Thesystem 1000, according to some embodiments, also or alternativelyincludes a database system 1040, an information feed 1082, and/or aninformation path 1084. In some embodiments, the components 1030, 1040 ofsystem 1000 may be similar in configuration and/or functionality to thesimilarly-named components described in conjunction with any of FIG. 2,FIG. 4, FIG. 6, FIG. 7, and/or FIG. 9 above.

The information redundancy engine 1030, according to some embodiments,prevents duplicate and/or unnecessary information from being storedand/or maintained by the system 1000. For example, the informationredundancy engine 1030 receives information from the information feed1082 via the information path 1084. In some embodiments, the informationis received by the information comparison device 1032. The informationcomparison device 1032, according to some embodiments, compares thereceived information to stored information and/or other informationalready within system 1000 and/or within the information redundancyengine 1030.

In some embodiments, the information comparison device 1032 compares thereceived information to information stored in and/or by the databasesystem 1040. According to some embodiments, the information comparisondevice 1032 utilizes the information extraction device 1034 to retrievestored information from the database system 1040. For example, theinformation comparison device 1032 submits a query to the databasesystem 1040 to identify information that is similar and/or associatedwith the received information. The information comparison device 1032then, in some embodiments, directs and/or causes the informationextraction device 1034 to retrieve the identified information from thedatabase system 1040.

In some embodiments, the information comparison device 1032 compares thereceived information with the information extracted from the databasesystem 1040. According to some embodiments, the information is comparedbased on various attributes, tags, relations, content, and/or otherinformation associated with the information to be compared. In someembodiments, if the received information is determined to be identicalor substantially identical to any information stored in the databasesystem 1040 (and/or extracted from the database system 1040 forcomparison), than the received information may be considered redundant.

In some embodiments, if the received information describes a particularevent, item, individual, and/or organization that already is describedby stored information, the received information is considered redundant.In some embodiments, a limited number of sources (e.g., informationpieces, groups, etc.) covering the same informational material may bestored, and any further such sources may be considered redundant.According to some embodiments, the information comparison device 1032determines a score, rank, and/or other metric associated with theredundancy of the received information. The redundancy rank, forexample, can be a metric representing the degree of redundancyassociated with an item of information. In some embodiments, informationthat is associated with a redundancy score over a pre-determinedredundancy limit is considered redundant.

According to some embodiments, the information comparison device 1032does not need to extract the stored information from the database system1040 in order to perform the comparison (e.g., in some embodiments theinformation extraction device 1034 may not be required in system 1000).In some embodiments, any information and/or portions of information thatare determined to be redundant may be filtered, deleted, removed, and/orotherwise disposed of. Similarly, any information that is determined notto be redundant is sent to and/or stored within the database system1040. According to some embodiments, the information comparison device1032 sends any non-redundant information to the information insertiondevice 1036.

The information insertion device 1036 then, for example, inserts,stores, and/or sends the information the database system 1040. In someembodiments, the information insertion device 1036 directly storesand/or causes the storage of the information in one or more databases(not shown in FIG. 10). The information insertion device 1036 may be orinclude, for example, a database driver and/or a Database Access Object(DAO). According to some embodiments, the information insertion device1036 is not required by system 1000 to store and/or cause the storage ofthe information. In some embodiments for example, the informationinsertion device 1036 is a separate device and/or is included withinanother device or component (e.g., within and/or as part of the databasesystem 1040).

In some embodiments, a staging table is used to insert the information.For example, in embodiments where a SQL Server is used, a datatransformation process may be invoked to control the insertion of data.The task reads and imports the data in the data packet into a temporarystaging table within the SQL Server. The staging table is configured tomatch the layout and format of the data being read from the data packetand all fields are propagated into the staging table.

Data from the staging table may then be mapped to the database scheme ina number of different ways. For example, simple scheme formats may bemapped and imported using SQL Server XML support. As another example,more complicated formats may use custom procedural code to populate andpreserve all the data elements in the imported data. In someembodiments, XML mapping is performed using XSLT data transformationstylesheets and XPATH queries to map the data from the data packet intothe database schema. Commercially available software, such as XMLSpy andMapForce may be used to facilitate this mapping.

The more complicated formats may require the use of procedural code andSQL Server Stored Procedures to manage the complex relational aspects ofthe data being imported. The code based importer uses import specificqueries to generate the datasets needed to populate the various databasetables. The task of creating a new code based importer component isreduced to creating the relational queries (Transact-SQL statements) toextract the various required datasets needed to populate the RDC schema.In some embodiments, much of the high-level functionality required tobuild an importer is contained in generic reusable code that may bewritten, for example, using the Microsoft .NET programming environment.For example, the importer specific code is written as subclasses of thebase importer and uses interface implementation to build new specificimporter components. Microsoft ADO.NET classes along with the MicrosoftVisual Studio development environment may be used in some embodiments tosimplify the task of creating importer components. The ADO.NET frameworkprovides an easy to use high-level set of tools to access relationaldata and stored procedures within the SQL Server environment, althoughother importing tools, scripts and procedures may also be used.

FIG. 11 shows a method 1100 according to some embodiments. In someembodiments, the method 1100 is conducted by and/or by utilizing any ofthe systems 100, 200, 400, 600, 700, 900, 1000 described above and/ormay be otherwise associated with any of the systems 100, 200, 400, 600,700, 900, 1000 and/or any of the system components (e.g., theinformation redundancy engine 230, 730, 930, 1030) described inconjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6, FIG. 7, FIG. 9,and/or FIG. 10 above. In some embodiments, the method 1100 may be orinclude a portion of and/or a procedure within other methods such asmethod 300 described above.

In some embodiments, the method 1100 begins at 1102 by receivinginformation determined to be relevant. For example, the informationcomparison device 1032 (and/or the information redundancy engine 1030)receives information that has been determined to be relevant (e.g., withrespect to risk) by the information relevancy engine 220, 420, 620, 720,920. In some embodiments, the information is received from other and/oradditional sources. According to some embodiments, other information mayalso be received. For example, information determined not to be relevantmay nonetheless be desired to be stored (e.g., for audit purposes, or incase the information later becomes or could become relevant).

The method 1100 continues, according to some embodiments, by comparingthe relevant information to stored information, at 1104. The informationcomparison device 1032, for example, compares various attributes,relations, content, tags, and/or other aspects of the information. Insome embodiments, the stored information to be compared to the receivedinformation is retrieved from the database system 1040 using theinformation extraction device 1034. Various information fields, in someembodiments, are loaded into a table or list (e.g., in temporary memory)to be compared. In some embodiments, the comparison includes checkingfor spelling errors and/or variances, interpreting information tocompare the meaning, content, and/or gist of the information, and/orcomparing combinations of fields and/or information types.

In some embodiments, the method 1100 continues at 1106 by identifyingredundant information. The information comparison device 1032 may, forexample, utilize the results of the comparison at 1104 to determine ifthe received information is redundant. In some embodiments, portions ofthe received information are evaluated for redundancy. According to someembodiments, the information is scored, ranked, and/or otherwiseassociated with a redundancy metric.

For each word, phrase, tagged field, and/or concept of the informationthat is determined to be redundant, for example, a score may beaccumulated. The higher the score, according to some embodiments, themore redundant the information is. In some embodiments, redundancyscores for various portions and/or fields of the information are added,averaged, and/or otherwise examined or manipulated to determine aredundancy for the information as a whole. According to someembodiments, information that is identical, similar, related, and/orotherwise associated is considered redundant. In some embodiments, eventhe slightest variation between information and/or database records maybe enough to consider the information non-redundant. In some embodimentsfor example, it may be desirable to store many variations in spellingand/or many aliases associated with a given name.

The method 1100 continues at 1108 by storing non-redundant information.The information comparison device 1032, for example, causesnon-redundant information to be stored in and/or by the database system1040. In some embodiments, the information insertion device 1036 isutilized to directly store non-redundant information in a database orother information store. In some embodiments, even information that isdetermined to be redundant is stored. For example, such information maybe stored for audit purposes and/or in case the information laterbecomes important and/or non-redundant. Particularly where the receivedinformation was purchased from a commercial source, it may not be deemedprudent to discard even redundant portions of the information. In someembodiments, any information to be stored may be sent to the databasesystem 1040 for storage.

Turning now to FIG. 12, a block diagram of a system 1200 according tosome embodiments is shown. In some embodiments, the system 1200 is usedto implement or perform and/or may otherwise be associated with any ofthe methods 300, 500, 800, 1100 (or any portions thereof) as describedin conjunction with any of FIG. 3, FIG. 5, FIG. 8, and/or FIG. 11 above.The system 1200 may, according to some embodiments, be similar inconfiguration and/or functionality to the system 1000 described above.

The system 1200, for example, includes an information redundancy engine1230. In some embodiments, the information redundancy engine 1230includes an information comparison device 1232, an informationextraction device 1234, an information insertion device 1236, and/or aninformation review device 1238. The system 1200, according to someembodiments, also or alternatively includes a database system 1240, aninformation feed 1282, and/or an information path 1284. In someembodiments, the components 1230, 1240 of system 1200 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with any of FIG. 2, FIG. 4, FIG. 6, FIG. 7,FIG. 9, and/or FIG. 10 above.

In some embodiments, the information feed 1282 may be or include theinformation feed 782, 982 from the information relevancy engine 720,920. The information feed 1282 includes, for example, information thatis standardized, tagged, and/or scored or ranked with respect torelevancy. According to some embodiments, the information may be orinclude various scanned documents such as, for example, real estatedeeds and/or other land records (e.g., restrictive covenants, bills ofsale, historic records, etc.). The deeds may, for example, be scannedand/or be converted electronically via Optical Character Recognition(OCR). In some embodiments, the deeds are transmitted along informationpath 1284 a to the information comparison device 1232.

The information comparison device 1232, according to some embodiments,utilize the deed information to structure one or more database queries.For example, deed information such as the transferee's name, thetransferor's name, the location of the land, the transfer date, and/or adescription of the land may be searched for within the database system1240. The information comparison device 1232, for example, submits sucha query (and/or one or more other queries) to the database system 1240.

In some embodiments, the query results are sent from the database system1240 to the information comparison device 1232. According to someembodiments, the query results are utilized, by the informationextraction device 1234 for example, to retrieve any database recordsfrom the database system 1240 that are likely to be similar to the deedinformation. The extracted query result information, for example, istransmitted along the information path 1284 b from the database system1240 to the information comparison device 1232 (e.g., via theinformation extraction device 1234).

The information comparison device 1232 then, for example, compares thedeed information to the stored information (e.g., the stored informationthat is likely to be similar to the deed information). The owner of theland as recorded in the land deed information may, for example, becompared to other landowner names, employee names, criminal names,and/or other names stored within the database system 1240. Other fieldsand/or portions of the deed information, such as the address of theproperty, may also or alternatively be compared to similar types ofstored information. In some embodiments, if many fields (e.g., name,address, price, date, etc.) match corresponding fields in the storedinformation, the deed information is considered redundant. If only someand/or certain fields match and/or are similar, than the deedinformation is considered non-redundant, according to some embodiments.

In some embodiments, if the deed information is determined to benon-redundant, the deed information is transmitted along the informationpath 1284 c to the information insertion device 1236. According to someembodiments, if the deed information (or any portion thereof) isdetermined to be redundant, the information is sent along theinformation path 1284 d to the information review device 1238. Theinformation review device 1238 is then used, for example, to verify theredundancy of the deed information. Any portions of the deed informationnot verified to be redundant may be re-joined with other non-redundantdeed portions by being transmitted to the information insertion device1236 via the information path 1284 d. In some embodiments, such as wherethe entire deed was originally determined to be redundant and then islater determined to be non-redundant (e.g., by the information reviewdevice 1238), the deed may be sent to the information insertion device1236.

According to some embodiments, the information insertion device 1236causes the deed information to be stored in the database system 1240.The information insertion device 1236, for example, sends the deedinformation to the database system 1240 via the information path 1284 e.In some embodiments, the information insertion device 1236 may not benecessary (e.g., the deed information is sent directly from theinformation comparison device 1232 and/or from the information reviewdevice 1238, to the database system 1240). In some embodiments, the deedinformation also or alternatively is stored in databases and/orinformation stores not within and/or associated with the database system1240.

Database

Referring now to FIG. 13, a block diagram of a system 1300 according tosome embodiments is shown. In some embodiments, the system 1300 is usedto implement or perform any of the methods 300, 500, 800, 1100 and/ormay otherwise be associated with any of the methods 300, 500, 800, 1100(or any portions thereof) as described in conjunction with any of FIG.3, FIG. 5, FIG. 8, and/or FIG. 11 above. The system 1300 may, forexample, be similar in configuration and/or functionality to thedatabase system 240, 440, 640, 1040, 1240 (or the risk server 102, 202)and/or may perform in accordance with the procedures 312, 314 asdescribed in conjunction with FIG. 3.

The system 1300, for example, includes database system 1340. In someembodiments, the database system 1340 includes one or more databases1342. The system 1300, according to some embodiments, also oralternatively includes an information matching engine 1350, aninformation feed 1384, and/or an information path 1386. In someembodiments, the components 1340, 1350 of system 1300 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with any of FIG. 2, FIG. 4, FIG. 6, FIG. 10,and/or FIG. 12 above.

The information feed 1384, according to some embodiments, includesinformation to be stored in the database 1342. The information feed 1384may be or include, for example, information transmitted along theinformation path 1284 from the redundancy engine 1230. In someembodiments, the information feed 1384 provides information to thedatabase system 1340 and/or to the database 1342 via the informationpath 1386. According to some embodiments, the database 1342 may be orinclude a repository for information associated with risk.

The database 1342, for example, includes multiple database tables and/orareas for storing information associated with risk in a relationalmanner. In some embodiments, the database 1342 includes one or more datastructures configured and/or designed to facilitate the identificationof risk. For example, various key risk segments (e.g., informationassociated with important risk factors) are arranged and/or linked orotherwise associated to allow efficient, comprehensive, and/or easyidentification of risk.

In some embodiments, access to the database 1342 and/or the databasesystem 1340 is provided to a user and/or other entity. According to someembodiments, the database 1342 I (or portions thereof) is provided to auser on a recordable storage medium such as a Compact Disk (CD), adownloadable file, and/or any other form of media that is or becomesavailable. In some embodiments, the information stored in the database1342 is provided and/or transmitted to the information matching engine1350. The information matching engine 1350, for example, allows a userto submit a query, and provide information from the database 1342 thatis associated with (and/or determined to be associated with) the query,to the user.

Turning now to FIG. 14, a method 1400 according to some embodiments isshown. In some embodiments, the method 1400 is conducted by and/or byutilizing any of the systems 100, 200, 400, 600, 700, 900, 1000, 1200,1300 described above and/or may be otherwise associated with any of thesystems 100, 200, 400, 600, 700, 900, 1000, 1200, 1300 and/or any of thesystem components (e.g., the database system 240, 440, 640, 1040, 1240,1340) described in conjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG.6, FIG. 7, FIG. 9, FIG. 10, FIG. 12, and/or FIG. 13 above. In someembodiments, the method 1400 may be or include a portion of and/or aprocedure within other methods such as method 300 described above.

In some embodiments, the method 1400 begins at 1402 by receivinginformation. The information, for example, is associated with risk. Theinformation is received from any practicable information sourceincluding, for example, one of the plurality of information sourcedevices 104, 204, the information gathering engine 210, 410, 610, theinformation relevancy engine 220, 420, 620, 720, 920, and/or theinformation redundancy engine 230, 730, 930, 1030, 1230. In someembodiments, the information is received from one or more devices thatsend, transmit, and/or otherwise provide the information to, forexample, the database system 1340. According to some embodiments, thedatabase system 1340 may retrieve, collect, solicit, and/or otherwiseacquire the information.

In some embodiments, the information is specially formatted (e.g., bythe information gathering engine 210, 410, 610), pre-analyzed forrelevancy (e.g., by the information relevancy engine 220, 420, 620, 720,920), and/or filtered for redundancy (e.g., by the informationredundancy engine 230, 730, 930, 1030, 1230). According to someembodiments, the information includes tags and/or other associated data,identifiers, and/or references that may be associated with risk (e.g., arelevancy score, a redundancy rank, etc.).

The method 1400 continues, according to some embodiments, by storing thereceived information in a data storage structure, at 1404. In someembodiments, the data storage structure is configured to facilitate theidentification of risk. For example, the data storage structure mayinclude a database schema that is arranged to assist with theidentification of risk. The database schema include various tablesand/or sets of tables that are arranged and linked to simplify thediscovery of relationships between key risk segments. In someembodiments, other types and/or configurations of data storagestructures are used to facilitate the identification of risk. Someembodiments describing practicable data storage structure configurationswill be described in relation to FIG. 16 through FIG. 35 below.

Turning first to FIG. 15, a block diagram of a system 1500 according tosome embodiments is shown. In some embodiments, the system 1500 is usedto implement or perform and/or may otherwise be associated with themethods 300, 500, 800, 1100, 1400 (or any portions thereof) as describedin conjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11, and/or FIG.14 above. The system 1500 may, according to some embodiments, be similarin configuration and/or functionality to the system 1300 describedabove.

The system 1500, for example, includes one or more user devices 1506, aninformation gathering engine 1510, an information redundancy engine1530, and/or database system 1540. In some embodiments, the databasesystem 1540 includes one or more databases 1542, a database managementdevice 1544, a data extraction device 1546, and/or a data insertiondevice 1548. The system 1500, according to some embodiments, also oralternatively includes an information matching engine 1550, aninformation delivery engine 1560, and/or information paths 1584, 1586,1588. In some embodiments, the components 1506, 1510, 1530, 1540, 1550,1560 of system 1500 are similar in configuration and/or functionality tothe similarly-named components described in conjunction with any of FIG.1, FIG. 2, FIG. 4, FIG. 6, FIG. 7, FIG. 9, FIG. 10, FIG. 12, and/or FIG.13 above.

In some embodiments, the database system 1540 receives information fromeither or both of the information redundancy engine (e.g., via theinformation path 1584) and the information gathering engine 1510 (e.g.,via the information path 1586). The information arrives, according tosome embodiments, at the data insertion device 1548. The data insertiondevice 1548, for example, inserts, adds, appends, and/or otherwisestores the information in the database 1542 (e.g., via the informationpath 1588). According to some embodiments, the data extraction device1546 is used to provide the stored information to various entitiesand/or devices. For example, to check and/or determine redundancy, theinformation redundancy engine 1530 uses the data extraction device 1546to pull queried information from the database 1542 (e.g., via theinformation path 1588 a).

According to some embodiments, the user device 1506 may query thedatabase 1542 for stored information. In some embodiments for example,the user device 1506 may submit a query for risk-related information tothe information delivery engine 1560 and/or to the information matchingengine 1550. The information delivery engine 1560 may, according to someembodiments, handle and/or conduct all direct communications with theuser device 1506. In some embodiments, the user device 1506 may also oralternatively communicate directly with the information matching engine1550 and/or with the database 1542. For example, the stored informationthat matches and/or otherwise satisfies the query submitted by the userdevice 1506 may be sent to the user device 1506 via various informationpaths.

In some embodiments, the information is sent via the information path1588 b from the database 1542 to the information matching engine 1550.The information matching engine 1550, for example, determines and/oridentifies the stored information that satisfies the query. In someembodiments, the information is pulled from the database 1542 byutilizing the data extraction device 1546 (e.g., via the informationpath 1588 c). The information may then, for example, be sent and/orprovided by the information matching engine 1550 directly to the userdevice 1506 via the information path 1588 d. In some embodiments, theinformation may also or alternatively be routed to and/or through theinformation delivery engine 1560 (e.g., via the information path 1588e).

The information delivery engine 1560, according to some embodiments,determines and/or identifies the stored information that satisfies thequery. In such embodiments, the information delivery engine 1560 pullsthe information directly from the database 1542 via the information path1588 f. In some embodiments, the data extraction device 1546 is used toobtain the information (e.g., via the information path 1588 g). Theinformation delivery engine 1560 includes any type of user and/or userdevice 1506 interface that is or becomes known. In some embodiments, theinformation delivery engine 1560 may be or include a web interface thatprovides query results and/or other stored information to the userdevice 1506 via the information path 1588 h.

In some embodiments, the information delivery engine 1560 may be orinclude a recordable storage medium on which the database 1542 and/or acopy thereof may be stored. According to some embodiments, theinformation delivery engine 1560 may also or alternatively includeprogram code and/or software (e.g., a Graphical User Interface (GUI), anApplication Program Interface (API), etc.) that may, for example,provide and/or facilitate access to the database system 1540 and/or thedatabase 1542. In some embodiments, the user device 1506 includes such aprogram and/or recordable medium. In such embodiments, the user devicemay, for example, directly communicates with and/or extracts informationfrom the database 1542 (e.g., via the information path 1588 i). In someembodiments, the data extraction device 1546 is used to pull the desiredstored information from the database 1542 (e.g., via the informationpath 1588 j).

According to some embodiments, the database management device 1544 maycontrol, monitor, audit, and/or facilitate the flow of informationwithin the database system 1540. In some embodiments, the databasemanagement device 1544 may also or alternatively manage and/or directthe storage of information within the database 1542. The databasemanagement device 1544, for example, uses the information path 1588 k tocommunicate directly with the database 1542. The database managementdevice 1544, according to some embodiments, creates, edits, maintains,and/or otherwise configures or manages a data storage structure (notshown in FIG. 15) within the database 1542. The data storage structuremay, for example, be a data storage structure as described elsewhereherein that is configured to facilitate the identification of risk.

Data Storage Schema

FIG. 16, for example, shows a block diagram of a data storage structure1600 according to some embodiments. The data structure 1600 may, forexample, be stored within a database and/or other storage device such asmay be included in any of the systems 100, 200, 400, 600, 700, 900,1000, 1200, 1300, and/or 1500 described herein. According to someembodiments, the data structure 1600 may be or include a specialstructure for storing data that is configured to facilitate theidentification of risk.

In some embodiments, the identification of risk relevant information isfacilitated through the use of key risk segments. In other words,specific types, groups, and/or categories of information are used toanalyze risk. In some embodiments for example, key risk segments mayinclude, but are not limited to, individuals and/or persons, itemsand/or objects, organizations and/or other entities, relationships(e.g., among the various other key risk segments), and/or addresses. Asshown in FIG. 16 for example, each and/or any of the key risk segmentsdetermined to be desirable and/or important for the identification ofrisk are represented by one or more tables or areas within a database(e.g., database 1342, 1542).

In some embodiments, the data structure 1600 includes person tables 1602and/or item tables 1620. The person tables 1602 may be or include, forexample, one or more tables designed to contain information relating tovarious attributes, aspects, and/or other information associated withindividuals. The person tables 1602 may include, for example,information associated with a particular person such as the person'sname, address, occupation, and/or age. Other information identifying aperson may also be provided. For example, in some embodiments, an“extended person table” (not shown) may be provided including furtherdetailed information associated with a person. For example, informationstored about a person may include: eye color, hair color, weight,height, passport number, driver's license number, social securitynumber, sex, race, complexion, language(s), scars and marks, aliases,known hobbies or interests, etc. Further, in some embodiments, photos orother images of the person may also be stored.

The person tables may include (or be associated with tables thatinclude) a variety of alternative descriptions for a person. Forexample, an alias table (not shown) may be associated with the persontable to include information about a variety of aliases used by aparticular person. A person may be associated with multiple titles,occupations, birth dates, etc. Similar tables may be used to capture andstore information associated with a person that includes multiplevariants.

In some embodiments, the person tables 1602 are linked and/or otherwiseassociated with the item tables 1620. The item tables 1620 generally(according to some embodiments) include tables configured to storeinformation associated with various information items and/or otherobjects. In some embodiments, the item tables 1620 include a publicationtable 1622. For example, the publication table 1622 may includeinformation associated with various published information items such asnewspaper articles, magazine articles, press releases, books, and/orother publications (e.g., patents, regulatory filings, etc.). The itemtables 1620 may also include tables configured to store informationassociated with crime information.

For example, different “incident codes” and crime descriptions may bespecified in an item table for association with different individuals(and for association with different events if appropriate). Otherinformation may also be provided in the item tables as will be apparentto those skilled in the art upon reading this disclosure.

In some embodiments, the data structure 1600 may also or alternativelyinclude organization tables 1640 and/or relationship tables 1660. Theorganization tables 1640 may be or include, for example, one or moretables arranged to store information associated with an organization,group, and/or other entity. Examples of organizations and/or otherentities may include, but are not limited to, businesses, partnerships,non-profit organizations, governments and/or government branches oragencies, and military or paramilitary groups. In some embodiments, therelationship tables 1660 may include a table relating a person to anevent (e.g., the relation_person_to_event table 1662), a table storinginformation associated with various events (e.g., the event table 1664),and/or a table relating an organization to a person (e.g., therelation_person_to_org table 1666).

In some embodiments for example, an organization may be associated witha particular person or other individual (e.g., a president of theorganization, a founder, a supporter, an employee, etc.). In suchembodiments, the relation_person_to_org table 1666 may link theappropriate organization information stored in the organization tables1640 to the appropriate person information stored in the person tables1602. Similarly, any relation between a person and an event (e.g., apresident and an election, a groom and a marriage, etc.) may bedescribed by a link formed between the person tables 1602 and the eventtable 1664, via the relation_person_to_event table 1662. In someembodiments, the event table 1664 may also or alternatively be linked tothe item tables 1620 (e.g., a particular newspaper article may describean election or other event).

In some embodiments, the data storage structure 1600 may also oralternatively include address information that may, for example, bestored in one or more global address tables 1690. Address informationassociated with any of an organization, a person, an event, aninformation item, and/or any other type of information and/or key risksegment may, for example, be stored in the global address tables 1690.According to some embodiments, the global address tables 1690 mayinclude a table for storing alternate addresses for persons (e.g., thealternate_person_address table 1692).

In some embodiments, the global address tables may also or alternativelyinclude a table for storing information associated with variouscountries (e.g., the country table 1694). An address associated with aperson may include country information, for example, and thus be linkedvia the global address tables 1690 and/or the country table 1694 to theperson tables 1602. In some embodiments, the country table 1694 may belinked to the person tables 1602 to indicate the citizenship of aperson.

Turning now to FIG. 17, a block diagram of a portion of a data storagestructure 1700 according to some embodiments is shown. The data storagestructure 1700 may, for example, be or include a portion of another datastorage structure such as the data storage structure 1600 describedabove. In some embodiments, the data storage structure 1700 may be orinclude a complete data storage structure and/or may be associated withother data storage structures or portions thereof. According to someembodiments, the data storage structure 1700 may be similar to and/orotherwise associated with the person tables 1602 described above inrelation to the data storage structure 1600. Other configurations oftables and/or links may be included in the data storage structure 1700and the other data storage structures described herein without deviatingfrom some embodiments.

The data storage structure 1700 may, according to some embodiments,include a person table 1702, a position table 1704, an occupation table1706, a nationality table 1708, a title table 1710, and/or an aliastable 1712. In some embodiments, the person table 1702 may be linked toan item table 1720, a relation_person_to_event table 1762, arelation_person_to_org table 1766, a relation_person_to_person table1768, a relation org_to_person table 1770, an alternate_person_addresstable 1792, and/or a country table 1794. In some embodiments, the tables1702, 1720, 1760, 1762, 1766, 1790, 1792, 1794 of the data storagestructure 1700 may be similar in configuration and/or functionality tothe similarly-named tables described in conjunction with FIG. 16 above.

According to some embodiments, the person table 1702 may includeinformation associated with a key risk metric (e.g., individuals). Forexample, individuals may often be associated with some form of risk. Insome embodiments, particular types of individuals that may be associatedwith risk include, but are not limited to, politically exposed persons(PEP), individuals with undesirable credit and/or financial history orperformance, individuals associated with socially unacceptable groups,acts, and/or positions, and/or individuals associated with crime and/orcriminal acts.

An investment firm may, for example, desire not to lend money and/orenter into other transactions with a foreign national known to beassociated with questionable human rights acts. To conduct business withsuch an individual may, for example, subject the firm to undesirableattention, scrutiny, and/or regulatory or legal action. In someembodiments therefore, information associated with such individuals (andothers) may be stored in a database (e.g., in the person tables 1702).

In some embodiments, the person table 1702 may link to other tablesassociated with key risk segments such as the item table 1720,relationship tables 1760 (e.g., including the tables 1762, 1766, 1768,1770), and/or global address tables 1790 (e.g., including tables 1792,1794).

As shown in FIG. 17 and as used herein generally, links between tablesmay be indicated with a directional arrow pointing either away from ortowards a particular table. Links pointing away from a table may,according to some embodiments, generally represent Foreign Key (FK)links to other tables (e.g., the linking field in the table is a FKrepresenting a Primary Key (PK) of another table). Links pointing towarda table may, for example, represent PK links to other tables (e.g., thelinking field is the table's PK). In some embodiments, other fields inaddition to or in place of a PK may be used for linking purposes. Thedirections and/or types of links may, according to some embodiments, bereversed, changed, and/or otherwise altered without deviating from someembodiments.

Further aspects, according to some embodiments, of the configuration ofthe data storage structure 1700, and the use and types of links and PKand FK fields, will be described in reference to FIG. 18 and FIG. 19below.

In FIG. 18, a schema diagram of an exemplary portion of a data storagestructure 1800 according to some embodiments is shown. The data storagestructure 1800 may be or include, for example, a portion of any of thedata storage structures 1600, 1700 described herein. According to someembodiments, the data storage structure 1800 may be similar to and/orotherwise associated with the person tables 1602 described above inrelation to the data storage structure 1600.

The data storage structure 1800 may, according to some embodiments,include a person table 1802, a position table 1804, an occupation table1806, a nationality table 1808, and/or a title table 1810. In someembodiments, the person table 1802 may be linked to (and/or furtherlinked to) an item table 1820 and/or a country table 1894. In someembodiments, the tables 1802, 1804, 1806, 1808, 1810, 1820, 1894 of thedata storage structure 1800 may be similar in configuration and/orfunctionality to the similarly-named tables described in conjunctionwith any of FIG. 16 and/or FIG. 17 above.

In some embodiments, the person table 1802 may contain various fieldsrelated to information associated with a person (as shown). The fieldsmay include, for example, fields relating to a person's name(“person_name”, “person_first”, “person_last”, etc.), and/or fieldsrelating to attributes of a person such as a person's political and/orprofessional capacity (“person_position”, “person_occupation”, etc.), aperson's age (“person_age”), and/or political exposure of the person(“pep”). The person table 1802 may, according to some embodiments,include a PK such as “person id” which may, for example be a uniqueidentifier associated with a person.

According to some embodiments, the person table 1802 may also include aFK. The FK may be or include, for example, an identifier that is uniquewithin another table and that is represented in the person table 1802 tolink the person table 1802 to the other table. More specifically,records within the person table 1802 may be linked via the FK to aspecific record in the other table. For example, as shown in FIG. 18,the person table includes six fields that are identified as a FK (e.g.,“position_id” as FK1, “occupation_id” as FK2, “country_id” as FK3,“nationality_id” as FK4, “person_title” as FK5, and “item_id” as FK6).

Each of the FK fields represents a link to an associated table. Forexample, the “person_title” field of the person table 1802 is a FK(e.g., FK5) that is a link to the “title_id” PK of the title table 1810.In such a manner for example, the person table 1802 may only need tostore a code and/or identifier (e.g., the numeral five) for the“person_title” field. Because the field is a FK referencing the titletable 1810, the code may correspond to a specific title (e.g., stored inthe “title” field) stored in the title table 1810. Similarly, othertables such as the position table 1804, the occupation table 1806, thenationality table 1808, and/or the country table 1894, may be linked tothe person table 1802.

In some embodiments, the person table 1802, which may be considered akey risk segment table, may also or alternatively connect and/or link toanother key risk segment table. For example, the person table 1802 ofFIG. 18 links to the item table 1820 via the “item_id” field. Accordingto some embodiments, the link between two or more key risk segmenttables may directly facilitate the identification of risk. For example,the link between the person table 1802 and the item table 1820 mayindicate an association between an individual and an item. In someembodiments for example, the link may associate a person with apublication such as an article or an advertisement.

In some embodiments, such a link and/or association may be important foridentifying risk. For example, a financial transaction involving anindividual may be initiated. Utilizing the special data organization ofthe data storage structure 1800, a financial advisor, manager, and/oremployee may, for example, easily and quickly locate the individual'sname with the person table 1802. The association to the item table 1820may, in some embodiments, indicate that the individual is mentioned inand/or authored an article condemning religious freedom. In such amanner, the individual may be determined to be suspect and/or otherwiseundesirable (e.g., dealing with the individual may open the financialinstitution to potential criticism and/or legal disputes regarding theinstitution's stance on certain issues such as religious freedom).

Referring now to FIG. 19, a schema diagram of an exemplary portion of adata storage structure 1900 according to some embodiments is shown. Thedata storage structure 1900 may be or include, for example, a portion ofany of the data storage structures 1600, 1700, 1800 described herein.According to some embodiments, the data storage structure 1900 may besimilar to and/or otherwise associated with the person tables 1602, 1802described above in relation to the data storage structures 1600, 1802described above.

The data storage structure 1900 may, according to some embodiments,include a person table 1902, and alias table 1912, arelation_person_to_event table 1962, a relation_person_to_org table1966, a relation_person_to_person table 1968, a relation_org_to_persontable 1970, and/or an alternate_person_address table 1992. In someembodiments, the tables 1902, 1912, 1962, 1966, 1968, 1970, 1992 of thedata storage structure 1900 may be similar in configuration and/orfunctionality to the similarly-named tables described in conjunctionwith any of FIG. 16, FIG. 17, and/or FIG. 18 above.

In some embodiments, the data storage structure 1900 may include linksbetween each of the alias table 1912, the relation_person_to_event table1962, the relation_person_to_org table 1966, therelation_person_to_person table 1968, the relation_org_to_person table1970, and/or the alternate_person_address table 1992 and the persontable 1902. In some embodiments, these links may be similar to thosedescribed in conjunction with the data storage structure 1800 describedabove. According to some embodiments, the links may associate one of thetables 1912, 1962, 1966, 1968, 1970, 1992 to the person table 1902 byincluding a field for storing the PK of the person table 1902 (e.g.,“person id”) in the other table.

For example, the alias table 1912 may include the “person_id” fieldwhich corresponds (e.g., as a FK) to the “person_id” field in the persontable 1902. The alias table 1912 may also, in some embodiments, includeits own PK, such as the “alias_id” field. In such a manner, for example,multiple unique alias names (e.g., “alias_name”) may be associated witha single person. Similarly, the relation_person_to_person table 1968 mayinclude the “person_id” as a FK (e.g., FK3) to the person table 1902. Insome embodiments, the relation_person_to_person table 1968 may alsoinclude a second field (e.g., “person_id_(—)2”) related to the“person_id” field of the person table 1902. In such a manner forexample, two individuals having information stored within the persontable 1902 may be linked, creating an association between two members ofthe “person” key risk segment.

Such an association may, according to some embodiments, be important forquickly and easily identifying risk. In some embodiments for example,while a person involved in a transaction may not necessarily beassociated with risk (or with much risk), the person may be related toand/or otherwise associated with a person to whom transactions should bedenied. The special organization of the fields and links within the datastorage structure 1900 may, in some embodiments, allow quick and/or easyidentification of such an important association.

FIG. 20 shows a block diagram of a portion of a data storage structure2000 according to some embodiments. The data storage structure 2000 maybe or include, for example, a portion of any of the data storagestructures 1600, 1700, 1800, 1900 described herein. According to someembodiments, the data storage structure 2000 may be similar to and/orotherwise associated with the item tables 1620, 1720, 1820 describedabove in conjunction with any of FIG. 16, FIG. 17, and/or FIG. 18 above.

In some embodiments, the data storage structure 2000 may include aperson table 2002, an item table 2020, a publication table 2022, ageo_coverage table 2024, a byline table 2026, an organization table2040, and/or an event table 2064 (that may be, for example, a tableassociated with relationship tables 2060). In some embodiments, thetables 2002, 2020, 2022, 2040, 2060, 2064 of the data storage structure2000 may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, and/or FIG. 19 above.

The item table 2020 may include, according to some embodiments,information associated with various items of information and/or otherobjects. In some embodiments, the item table 2020 may link to thepublication table 2022 which may, for example, store informationassociated with one or more publications such as newspapers and otherarticles. The item table 2020 may, according to some embodiments, linkto the geo_coverage table 2024. The geo_coverage table 2024 may, forexample, store information describing the geographical scope of anitem's content and/or market coverage. In some embodiments, the itemtable 2020 may link to the byline table 2026. For example, the bylinetable 2026 may include authorship and/or other important informationrelating to a publication and/or article.

According to some embodiments, the item table 2020 may be a key risksegment table. The item table 2020 may, for example, include informationabout articles and other informational items that are deemed importantfactors in identifying risk. In some embodiments for example, newsarticles and other sources of information (e.g., government lists,criminal records, etc.) may be one of the key risk segments used todetermine risk-related relationships and associations. According to someembodiments, the item table 2020 may be linked to other key risk segmenttables (e.g., the person table 2002, the organization table 2040, and/orthe relationship tables 2060). In some embodiments, the associationsand/or links between the key risk segment tables 2002, 2020, 2040, 2060may directly facilitate the identification of risk (e.g., by allowingquick and easy identification of the important risk-relatedassociations).

In FIG. 21, a schema diagram of an exemplary portion of a data storagestructure 2100 according to some embodiments is shown. The data storagestructure 2100 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000 described herein.According to some embodiments, the data storage structure 2100 may besimilar to and/or otherwise associated with the item tables 1620, 1720,1820, 2020 described above in conjunction with any of FIG. 16, FIG. 17,FIG. 18., and/or FIG. 20.

The data storage structure 2100 may, according to some embodiments,include an item table 2120, a publication table 2122, a geo_coveragetable 2124, an aggregator table 2128, a publication_language table 2130,a publication_type table 2132, and/or a global_address table 2190. Insome embodiments, the tables 2120, 2122, 2124, 2128, 2130, 2132, 2190 ofthe data storage structure 2100 may be similar in configuration and/orfunctionality to the similarly-named tables described in conjunctionwith any of FIG. 16, FIG. 17, FIG. 18, and/or FIG. 20 above.

In some embodiments, the item table 2120 may include various fieldsand/or keys (e.g., a PK, a FK, etc.) that contain information relatingto one or more items of information. The items of information may, forexample, be or include collected, aggregated, tagged, filtered, and/orotherwise analyzed (e.g., for relevancy and/or redundancy) informationreceived from various sources (e.g., the information redundancy engine230, 730, 930, 1030, 1230, 1530, the information gathering engine 210,410, 610, 1510, etc.). According to some embodiments, the item table2120 may include, for example, fields relating to an item's authorship(“item_author”), an item's origin and/or type (“item_type”, “item_date”,“item_location”, etc.), and/or various attributes of the item(“item_format”, “item_length”, etc.).

In some embodiments, the item table 2120 may be linked to thepublication table 2122. The “pub_id” field (FK1) may, for example, linkan item and/or associated information to publication information relatedto the same item. The publication table 2122 may include, in someembodiments, fields relating to the publication of an item such as a“publication_name” field, a “publisher” field, a“publication_language_id” field, and/or and “address_id” field. In someembodiments, the “address_id” field may by a FK (e.g., FK2) to theglobal_address table 2190. The link may associate, for example, one ormore addresses to the publication. In some embodiments, an address maybe associated by being an address of the publisher, and address listedor mentioned in the publication, and/or another type and/or form ofassociated address.

According to some embodiments, the item table 2120 may be a key risksegment table. Similarly, the global_address table 2190 may, accordingto some embodiments, be considered a key risk segment table. In someembodiments, the two tables 2120, 2190 may be linked (e.g., via thepublication table 2122). Such a link may, for example, represent anassociation between an item and an address. For example, ananti-American newsletter may be published by a group or individualresiding at and/or operating out of a particular address. Thepublication may be linked with that address via the “address_id” fieldstored in both the global_address table 2190 and the publication table2122. In some embodiments, the global_address table 2190 may contain afield (e.g., “item_id”) linking the global_address table 2190 and/or aparticular address directly to the item table 2120 and/or a particularitem.

Such an association between an item (such as a publication) and anaddress may provide many advantages. In some embodiments for example,the association may be associated with risk (e.g., as described above inrelation to an anti-American newsletter). According to some embodiments,the association between an item and an address may, for example, allow auser to quickly and/or easily determine risk. The user may, for example,be considering providing a mortgage to an organization for a propertylocated at a specific address. The layout of the data storage structure2100 may, in some embodiments, allow the user to quickly and easilydetermine that the address is associated with a type of publication(and/or a specific publication) that it is not desirable to beassociated with. In such a manner for example, the user may evaluate anyrisk associated with the address and take measures (e.g., terminatingthe transaction) that may reduce the amount of risk that the user may beexposed to.

In FIG. 22, a schema diagram of an exemplary portion of a data storagestructure 2200 according to some embodiments is shown. The data storagestructure 2200 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100 describedherein. According to some embodiments, the data storage structure 2200may be similar to and/or otherwise associated with the item tables 1620,1720, 1820, 2020, 2120 described above in conjunction with any of FIG.16, FIG. 17, FIG. 18, FIG. 20, and/or FIG. 21 above.

The data storage structure 2200 may, according to some embodiments,include a person table 2202, an item table 2220, a byline table 2226, anorganization table 2240, and/or an event table 2264. In someembodiments, the tables 2202, 2220, 2226, 2240, 2264 of the data storagestructure 2200 may be similar in configuration and/or functionality tothe similarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 20, and/or FIG. 21 above.

In some embodiments, the byline table 2226 may be linked to the itemtable 2220 (e.g., via the “item_id” field). The byline table 2226 may,for example, be linked in a many-to-one fashion with the item table2220. In other words, one or more “byline_id” fields and/or “author”fields may be associated with any particular “item_id”. Where multipleauthors are responsible for contributing to a publication or other item,for example, a record for each author may be stored in the byline table2226. In some embodiments, such an association allows multiple authorsto be associated with a particular item.

According to some embodiments, the item table 2220 may be considered akey risk segment table (e.g., as described elsewhere herein). In someembodiments, the item table 2220 may be linked and/or otherwiseassociated with other key risk segment tables such as the person table2202, the organization table 2240, and/or the event table 2264 (whichmay be, for example, one of the relationship tables 1660, 1760, 2060).According to some embodiments, the item table 2220 may containinformation associated with and/or otherwise representing an item suchas a publication. The publication may, for example, be associated withan “item_id” field and/or with a “pub_id” field.

In some embodiments, the publication may describe a fundraising eventheld by a corporation to benefit a political candidate. The variousassociations between the publication, the organization, the fundraiser,and the candidate may, according to some embodiments, be represented bythe data storage structure 2200. For example, the publicationinformation in the item table 2220 may be linked to the organizationinformation stored in the organization table 2240 via the “item_id”field. Similarly, the item table 2220 may be linked to the person table2202 via the “item_id” field, relating one or more persons (in thiscase, for example, the political candidate) to the publication. Further,the record associated with the publication that is stored in the itemtable 2220 may be linked to one or more records in the event table 2264via the “item_id” field.

Other items of information associated with organizations may beprovided. For example, pursuant to some embodiments, an organization maybe a shipping organization having a number of vessels or ships,aircraft, or other vehicles. As a specific example, an organization maybe associated with information stored in one or more table(s)identifying specific vessels (e.g., including information identifyingeach vessel's call sign, type, tonnage, flag, etc.).

In some embodiments, the layout of the tables, links, and/or dataelements of the data storage structure 2200 may facilitate theidentification of risk. For example, the associations between thevarious aspects of the political fundraising event described above maybe easily identified based upon the links between the appropriate keyrisk segment tables. In some embodiments, a user may easily and/orquickly be able to identify risk and/or risk factors associated with anindividual, item, event, and/or organization. The user may, for example,search the data storage structure for information regarding theorganization. The links and/or associations between the key risk segmenttables, according to some embodiments, would allow the user to easilyidentify that the political candidate, for example, is connected to theorganization (e.g., a factor that may be related to political and/orother risk).

Turning now to FIG. 23, a block diagram of a portion of a data storagestructure 2300 according to some embodiments is shown. The data storagestructure 2300 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200described herein. According to some embodiments, the data storagestructure 2300 may be similar to and/or otherwise associated with theorganization tables 1640, 2040, 2240 described above in conjunction withany of FIG. 16, FIG. 20, and/or FIG. 22 above.

In some embodiments, the data storage structure 2300 may include anorganization table 2340, an organization_type table 2342, an industrycategory_table 2344, an alias_organization table 2346, an item table2320, a global_address table 2390, a country table 2394, analternate_org_address table 2396, a relation_person_to_org table 2366, arelation_org_to_person table 2370, a relation_org_to_event table 2372,and/or a relation_org_to_org table 2374. In some embodiments, the tables2320, 2340, 2360, 2366, 2370, 2390, 2394 of the data storage structure2300 may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20, FIG. 21, and/or FIG. 22 above.

The organization table 2340 may include, according to some embodiments,information associated with various organizations, businesses,governments, and/or other entities. In some embodiments, theorganization table 2340 may be linked to the organization_type table2342. The organization_type table 2342 may, according to someembodiments, store information relating to the type of organization(e.g., non-profit, political action, business, trade union, etc.). Insome embodiments, the organization table 2340 may be linked to theindustry_category table 2344. The industry_category table 2344 maystore, for example, information relating to the industry and/or categoryof the organization. In some embodiments, the industry category may beor include a Standard Industrial Classification (SIC) code and/or otherindustrial identifier (e.g., based on the International Organization forStandards (ISO) 9001:2000 certification, etc.).

The organization table 2340 may also or alternatively be linked to thealias_org table 2346. The alias_org table 2346 may include, for example,information relating an organization to an alias organization. In someembodiments, the alias organization may be another name by and/or underwhich the organization does business and/or is known, a parent, child,and/or sibling organization, and/or any other type of relatedorganization (e.g., predecessor organization, etc.). In someembodiments, the alias tables described herein (e.g., the alias_orgtable 2346) may associate various spellings of an organization's name.Different language variations and/or foreign spellings and/orabbreviations, may for example, be related via the alias_org table 2346to the organization table 2340.

In some embodiments, the organization table 2340 may be a key risksegment table. Relations to other key risk segment tables such as theitem table 2320, the global_address tables 2390, and/or the relationtables 2360 may, according to some embodiments, be identified via linksbetween the respective tables. The organization table 2340 may, forexample, be linked to the country table 2394, which may storeinformation associating an organization with one or more countries(e.g., of incorporation, place of business, market coverage, etc.). Insome embodiments, the organization table 2340 may be linked to thealternate_org_address table 2396, which may, for example, associate anorganization with one or more alternate addresses (e.g., addresses ofbranch offices, different departments, etc.).

According to some embodiments, the organization table 2340 may be linkedto various relationship tables 2360 (e.g., including therelation_person_to_org table 2366, the relation_org_to_person table2370, the relation_org_to_event table 2372, and/or therelation_org_to_org table 2374). The relationship tables 2360 may each,according to some embodiments, associate an organization of theorganization table 2340 with other entities. For example, therelation_org_to_org table 2374 may link to the organization table 2340to represent an association between two or more organizations that arerepresented in the organization table 2340. In some embodiments, suchlinks between key risk segments may facilitate the identification ofrisk.

In FIG. 24, a schema diagram of an exemplary portion of a data storagestructure 2400 according to some embodiments is shown. The data storagestructure 2400 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300described herein. According to some embodiments, the data storagestructure 2400 may be similar to and/or otherwise associated with theorganization tables 1640, 2040, 2240, 2340 described above inconjunction with any of FIG. 16, FIG. 20, FIG. 22, and/or FIG. 23.

The data storage structure 2400 may, according to some embodiments,include an organization table 2440, an organization_type table 2442, anindustry_category table 2444, an alias_organization table 2446, aglobal_address table 2490, a country table 2494, and/or analternate_org_address table 2496. In some embodiments, the tables 2440,2442, 2444, 2446, 2490, 2494, 2496 of the data storage structure 2400may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20, FIG. 21, FIG. 22, and/or FIG. 23above.

In some embodiments, the organization table 2440 may include variousfields and/or keys (e.g., a PK, a FK, etc.) that contain informationrelating to one or more organization and/or other entities. Theorganizations may include, for example, government agencies, social orpolitical action groups, and/or other societies, groups, and/orentities. According to some embodiments, the organization table 2440 mayinclude fields that relate to an organization's attributes(“organization_name”, “place_of_incorporation”, etc.) and/or that relateto identifiers and/or keys that are associated with organizationattributes (e.g., “organization_type_id”, “industry_category_id”,“organization_tax_id”, etc.).

In some embodiments, the organization table 2440 may be a key risksegment table. For example, many organizations are associated withprinciples, acts, images, and/or beliefs that are offensive, abusive,and/or harmful to others. Such organizations may, according to someembodiments, not be deemed desirable to do business with. In someembodiments, identification of associations with such organizations maybe important to determining risk. In some embodiments for example, riskassociated with an organization from the organization table 2440 may beidentified by an association between the organization and an aliasorganization (e.g., that is known to be a suspect organization) asidentified by a link to the alias organization table 2446.

Referring now to FIG. 25, a schema diagram of an exemplary portion of adata storage structure 2500 according to some embodiments is shown. Thedata storage structure 2500 may be or include, for example, a portion ofany of the data storage structures 1600, 1700, 1800, 1900, 2000, 2100,2200, 2300, 2400 described herein. According to some embodiments, thedata storage structure 2500 may be similar to and/or otherwiseassociated with the organization tables 1640, 2040, 2240, 2340, 2440described above in conjunction with any of FIG. 16, FIG. 20, FIG. 22,FIG. 23, and/or FIG. 24.

The data storage structure 2500 may, according to some embodiments,include an organization table 2540, a relation_person_to_org table 2566,a relation_org_to_person table 2570, a relation_org_to_event table 2572,and/or a relation_org_to_org table 2574. In some embodiments, the tables2540, 2566, 2570, 2572, 2574 of the data storage structure 2500 may besimilar in configuration and/or functionality to the similarly-namedtables described in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, and/or FIG. 24 above.

In some embodiments, the organization table 2540 may include informationassociated with one or more organizations and/or other entities (e.g.,as described elsewhere herein). The organization table 2540 may, forexample, contain information associated with a chemical manufacturer. Insome embodiments, the organization table 2540 may link to therelation_org_to_org table 2574. The relation_org_to_org table 2574 may,for example, contain information associating the chemical manufacturerwith a particular subsidiary company. According to some embodiments, theorganization table 2540 may also or alternatively link to therelation_org_to_event table 2572. For example, the relation_org_to_eventtable 2572 may contain information that associates the subsidiarycompany with a particular event such as a chemical spill.

According to some embodiments, the organization table 2540 may be linkedto the relation_person_to_org table 2566. For example, therelation_person_to_org table 2566 may contain information thatassociates an individual one or more organizations such as to thechemical manufacturer and/or the subsidiary company. Such an individualmay include, for example, a chief executive officer (CEO) or president,an employee (e.g., that caused the spill), a safety compliance officer,and/or any other associated individual. In some embodiments, theorganization table 2540 may also or alternatively be linked to therelation_org_to_person table 2570. The relation_org_to_person table 2570may, for example, contain information relating an organization to one ormore individuals.

In some embodiments, only one of the relation_org_to_person table 2570and the relation_person_to_org table 2566 may be included in the datastorage structure 2500. According to some embodiments, the link betweenthe organization table 2540 and one of the relation_person_to_org table2566 and the relation_org_to_person table 2570 may be a one-to-manylink, while the link between the organization table 2540 and the otherof the relation_org_to_person table 2570 and the relation_person_to_orgtable 2566 may be a many-to-one link.

According to some embodiments, the links between the organization tableand the various relation tables 2560 may facilitate the identificationof risk. In some embodiments for example, a first organization may belinked to an event, and the event may be linked to an individual.Further, the individual may be linked to a second organization, and thesecond organization may be linked to a third organization. Each of thelinks described above may, for example, be exemplified by the linksbetween the various tables of the data storage structure 2500. Accordingto some embodiments, the chair of association between various events,organizations, items, and/or individuals may be utilized to identifyrisk. In some embodiments for example, the closer a risk-related entity(like a known criminal) appears to another entity (like an organization)in the chain of links and/or associations, the more risk there is thatmay be attributed to the other entity. According to some embodiments, arisk score may be directly (or inversely) proportional to the degree ofseparation between two or more entities.

FIG. 26 shows a block diagram of a portion of a data storage structure2600 according to some embodiments. The data storage structure 2600 maybe or include, for example, a portion of any of the data storagestructures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300, 2400, 2500described herein. According to some embodiments, the data storagestructure 2600 may be similar to and/or otherwise associated with therelationship tables 1660, 1760, 2060, 2360, 2560 described above inconjunction with any of FIG. 16, FIG. 17, FIG. 20, FIG. 23, and/or FIG.25 above.

In some embodiments, the data storage structure 2600 may include anevent table 2664, an item table 2620, a global_address table 2690, arelation_person_to_event table 2662, a relation_org_to_event table 2672,a relation event to event table 2676, arelationship_problem_code_occurence table 2678, and/or arelationship_occurence_keyword table 2680. In some embodiments, thetables 2620, 2662, 2664, 2672 of the data storage structure 2600 may besimilar in configuration and/or functionality to the similarly-namedtables described in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, and/or FIG. 25above.

According to some embodiments, the event table 2664 may includeinformation associated with various events and/or happenings. The eventtable 2664 may, for example, contain information related to variouspolitical, social, economic, public, and/or private events. Events mayinclude, but are not limited to, elections, convictions, verdicts,marriages, births, deaths, financial transactions, wars, conflicts,stock prices, and weather events. In some embodiments, the informationassociated with the one or more events may be derived, aggregated,and/or compiled from one or more items of information. Items ofinformation stored in the item tables 1620, 1720, 1820, 2020, 2120,2220, 2320, for example, may be analyzed, parsed, and/or otherwiseexamined and/or processed to extract, retrieve, and/or otherwisedetermine or identify the event information stored in the event table2664.

In some embodiments, the event table 2664 may be linked to therelationship_occurence keyword table 2680. The relationship_occurencekeyword table 2680 may, for example, store information relating tovarious keywords which may be associated with events, types of events,and/or risk. For example, the relationship_occurence keyword table 2680may contain keywords that are used to search through availablerelationship information to determine risk and/or relevancy. In someembodiments, the event table 2664 may also or alternatively be linked tothe relationship_problem_code_occurence table 2678. According to someembodiments, the relationship_problem_code_occurence table 2678 mayinclude information relating to errors, problems, and/or other issuesrelating to various relationships.

The event table 2664, according to some embodiments, may be linked tothe relation_org_to_event table 2672, the relation_event_to_event table2676, and/or the relation_person_to_event table 2662. For example, eachof the linked tables 2662, 2672, 2676 may associate one or more eventswith one or more other entities, events, and/or other objects. In someembodiments, the relation_event_to_event table 2676 may, for example,associate two or more events having information stored within the eventtable 2664. According to some embodiments, the links between the eventtable 2664 and the other linked tables 2662, 2672, 2676 may be orinclude one-to-many links, many-to-one links, and/or any combinationthereof.

In some embodiments, the event table 2664 may be a key risk segmenttable. For example, certain events may be important to determiningand/or otherwise identifying risk. According to some embodiments, theevent table 2664 may be linked to other key risk segment tables such asthe item table 2620 and/or the global_address table 2690. In someembodiments, the links and/or associations between the various key risksegment tables 2664, 2620, 2690 may facilitate the identification ofrisk. For example, an event that is known to be associated with risk andis stored in the event table 2664 may be associated with an item (e.g.,a publication) stored in the item table 2620 and/or an address stored inthe global address table 2690. In such a manner for example, the itemand/or the address may be easily identified as being associated with arisk-relevant event.

Turning now to FIG. 27, a schema diagram of an exemplary portion of adata storage structure 2700 according to some embodiments is shown. Thedata storage structure 2700 may be or include, for example, a portion ofany of the data storage structures 1600, 1700, 1800, 1900, 2000, 2100,2200, 2300, 2400, 2500, 2600 described herein. According to someembodiments, the data storage structure 2700 may be similar to and/orotherwise associated with the relationship tables 1660, 1760, 2060,2360, 2560, 2660 described above in conjunction with any of FIG. 16,FIG. 17, FIG. 20, FIG. 23, FIG. 25, and/or FIG. 26 above.

The data storage structure 2700 may, according to some embodiments,include an event table 2764, an item table 2720, a global_address table2790, a relation_event_to_event table 2776, arelationship_problem_code_occurence table 2778, a problem_code table2784, and/or a relationship_type table 2786. In some embodiments, thetables 2720, 2764, 2776, 2778, 2790 of the data storage structure 2700may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24,FIG. 25, and/or FIG. 26 above.

In some embodiments, the event table 2764 may include informationrelating to various events. For example, the even table 2764 may includefields relating to attributes of an event (“event_name”, “event_date”,etc.). In some embodiments, the event table 2764 may be linked to theglobal address table 2790 (e.g., via the FK “event_location_id” link tothe PK “address_id”). For example, via a one-to-many link between theevent table 2764 and the gobal_address table 2790, an event may beassociated with one or more addresses.

According to some embodiments, the event table 2764 may be linked to theitem table 2720 (either or both of which may be, for example, key risksegment tables). In some embodiments, an event having information storedin the event table 2764 may, for example, be related (e.g., via a link)to one or more items (such as publications) stored in the item table2720. According to some embodiments, the event table 2764 may also oralternatively be linked to relationship_event_to_event table 2776. Forexample, an event stored in the event table 2764 may be linked to one ormore other events stored in the event table 2764 via therelationship_event_to_event table 2776. In some embodiments, therelationship_event_to_event table 2776 may include a “relationship_type”field that describes and/or otherwise relates to the type ofrelationship between the events. In some embodiments, the relationshipevent to event table 2776 may also or alternatively include a“relationship_type_id” field (not shown in therelationship_event_to_event table 2776 in FIG. 27) that may link, forexample, to the relationship_type table 2786 (link not shown in FIG.27).

According to some embodiments, the event table 2764 may be linked to therelation_problem_code_occurence table 2778 which may, for example, befurther linked to the problem_code table 2784 and/or therelationship_type table 2786. In some embodiments, therelation_problem_code_occurence table 2778 may contain, for example,information relating to a problem associated with a relationship. Theproblem may include, for example, a technical issue, an error, a risk,and/or any other type of issue and/or problem. In some embodiments, theproblem may be associated with a “problem_code_id” that may, forexample, be a FK link to the problem_code table 2784.

The problem_code table 2784 may, according to some embodiments, includea code, description, and/or other explanation and/or identifierassociated with a particular problem type (e.g., “problem code”). Insome embodiments, the relationship_type table 2786 may be similarlylinked to the relation_problem_code_occurence table 2778 to identify oneor more particular types of relationships associated with an event. Insome embodiments, the relationship_type table 2786 and/or theproblem_code table 2784 may be used to identify features of problemsand/or relationships other than and/or instead of in relation to events.

For example, FIG. 28 shows a schema diagram of an exemplary portion of adata storage structure 2800 according to some embodiments. The datastorage structure 2800 may be or include, for example, a portion of anyof the data storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200,2300, 2400, 2500, 2600, 2700 described herein. According to someembodiments, the data storage structure 2800 may be similar to and/orotherwise associated with the relationship tables 1660, 1760, 2060,2360, 2560, 2660, 2760 described above in conjunction with any of FIG.16, FIG. 17, FIG. 20, FIG. 23, FIG. 25, FIG. 26, and/or FIG. 27 above.

The data storage structure 2800 may, according to some embodiments,include an event table 2864, a relation_person_to_event table 2862, arelationship_occurrence_keyword table 2880, a keyword_list table 2882, arelation_org_to_event table 2872, a relation_person_to_person table2868, a relation_person_to_org table 2866, a relation_org_to_persontable 2870, a relation_org_to_org table 2874, and/or a relationship_typetable 2886. In some embodiments, the tables 2862, 2864, 2866, 2868,2870, 2872, 2874, 2880, 2886 of the data storage structure 2800 may besimilar in configuration and/or functionality to the similarly-namedtables described in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 25, FIG. 26,and/or FIG. 27 above.

In some embodiments, the relationship tables 2860 may include akeyword_list table 2882. The keyword_list table 2882 may, for example,contain records for various keywords (e.g., stored in the “keyword”field). In some embodiments, one or more of the keywords may be orinclude a keyword that is determined to be associated with risk. Forexample, keywords, terms, and/or phrases may include, but are notlimited to, “convicted”, “arrested”, “indicted”, “suspected of”, “fled”,“in hiding”, “exiled”, and “defaulted”. Such words, terms, and/orphrases may, for example, be determined to have a likelihood of beingassociated with risk. According to some embodiments, the keywords of thekeyword_list table 2882 may be linked to therelationship_occurence_keyword table 2880.

The relationship_occurence_keyword table 2880 may, for example, storeinformation associated with various events, relationships, and/orkeywords. In some embodiments, the relationship_occurence_keyword table2880 may link to the keyword_list table 2882 via the “keyword_id” field.The relationship_occurence_keyword table 2880 may, in some embodiments,store information relating to occurrences of keywords found in relationto certain events and/or relationships. For example, every occurrence ofa keyword within information associated with an event may be representedby a record (e.g., in the relationship_occurence_keyword table 2880)linking the event information stored in the event table 2864 and thekeyword information stored in the keyword_list table 2880. In someembodiments, the event table 2864 may be linked to multiple otherrelations tables 2860. As shown in FIG. 28 for example, the event table2864 may be associated with persons and/or organizations via links tothe relation_person_to_event table 2862 and/or to therelation_org_to_event table 2872. According to some embodiments, many orall of the relation tables 2860 may link to the relationship_type table2886. The relationship_type table 2886 may, for example, be a lookuptable that contains information describing relationship types that arereferenced by the “relationship_type_id” field.

Referring now to FIG. 29, a block diagram of a portion of a data storagestructure 2900 according to some embodiments is shown. The data storagestructure 2900 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 2800 described herein. According to someembodiments, the data storage structure 2900 may be similar to and/orotherwise associated with the address tables 1690, 1790, 2190, 2390,2490, 2790 described above in conjunction with any of FIG. 16, FIG. 17,FIG. 21, FIG. 23, FIG. 24, and/or FIG. 27 above.

In some embodiments, the data storage structure 2900 may include aglobal_address table 2990, a geo_code table 2999, a zip_code table 2998,a country_code table 2994, an aggregator table 2928, a publication table2922, an alternate_organization_address table 2996, analternate_person_address table 2992, an event table 2964, and/or anorganization table 2940. In some embodiments, the tables 2922, 2928,2940, 2964, 2990, 2992, 2994, 2996 of the data storage structure 2900may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24,FIG. 26, FIG. 27, and/or FIG. 28 above.

According to some embodiments, the global_address table 2990 may includeinformation relating to addresses and/or other location and/orgeographic positions. In some embodiments, the global_address table 2990may store postal address information. The global_address table 2990 may,according to some embodiments, link to various other tables such aslookup tables. In some embodiments, lookup tables linked to theglobal_address table 2990 may include, but are not limited to, thezip_code table 2998, the geo_code table 2999, and/or the country table2994. For example, the zip_code table 2998 may link to the gobal_addresstable 2990 and may store information associated with zip code and/orother postal codes. Similarly, the country_code table 2994 may containinformation associated with various countries, provinces, and/or states.In some embodiments, the geo_code table 2999 may contain informationrelating to geographic, political, and/or other relational areas and/orregions.

In some embodiments, the aggregator table 2928 may link to theglobal_address table 2990. The aggregator table 2928 may store, forexample, information associated with data and/or informationaggregation. In some embodiments, information may be aggregated based onregional and/or other location information. In such embodiments, theaggregator table 2928 may, for example, link to the global_address tableto associate various aggregations with appropriate regional and/orlocation codes and/or other information (e.g., localities, addresses,etc.).

The publication table 2922, the alternate_organization_address table2996, and/or the alternate_person_address table 2992 may, according tosome embodiments, be linked to the global_address table 2990. Forexample, each or any of the linked tables 2922, 2992, 2996 may link tothe global_address table 2990 to associate various publications,organizations, and/or persons, respectively, to one or more addressesand/or other location information. In some embodiments, theglobal_address table 2990 may link to other and/or additional tablesthat contain information associated with one or more addresses.

In some embodiments, the global_address table 2990 may be a key risksegment table. According to some embodiments, an address may beassociated with risk. For example, a real estate property associatedwith an address may contain and/or otherwise be associated withliability. In some embodiments, the property may be subject to liens orjudgments and/or may contain contamination or other environmental,occupational, and/or political risk. Some properties, for example, maybe located in an area for which ownership and/or sovereignty is disputedbetween one or more entities and/or nations.

The global_address table 2990 may, according to some embodiments, belinked to other key risk segment tables. The global_address table 2990may, for example, link to the event table 2964 and/or to theorganization table 2940. In some embodiments, the global_address table2990 may store address and/or other location information associated withevents and/or organizations having information stored within the eventtable 2964 and/or the organization table 2940, respectively. In someembodiments, the association between two or more risk segments (e.g., anaddress and an organization, an address and an event, etc.) mayfacilitate the identification of risk. If an address that is related toa known Superfund Site is identified as related to an organization, forexample, it may be determined that the organization is associated withrisk (e.g., environmental liability).

In FIG. 30, a schema diagram of an exemplary portion of a data storagestructure 3000 according to some embodiments is shown. The data storagestructure 3000 may be or include, for example, a portion of any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 2800, 2900 described herein. According to someembodiments, the data storage structure 3000 may be similar to and/orotherwise associated with the address tables 1690, 1790, 2190, 2390,2490, 2790, 2990 described above in conjunction with any of FIG. 16,FIG. 17, FIG. 21, FIG. 23, FIG. 24, FIG. 27, and/or FIG. 29.

The data storage structure 3000 may, according to some embodiments,include a global_address table 3090, a geo_code table 3099, a zip_codetable 3098, a country_code table 3094, an aggregator table 3028, apublication table 3022, an alternate_organization_address table 3096, analternate_person address table 3092, an event table 3064, and/or anorganization table 3040. In some embodiments, the tables 3022, 3028,3040, 3064, 3090, 3092, 3094, 3096 of the data storage structure 3000may be similar in configuration and/or functionality to thesimilarly-named tables described in conjunction with any of FIG. 16,FIG. 17, FIG. 18, FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24,FIG. 26, FIG. 27, FIG. 28, and/or FIG. 29 above.

In some embodiments, the global_address table 3090 may includeinformation relating to various addresses and/or other locationidentifiers or information. For example, the global_address table 3090may include fields relating to a postal address (e.g., “address_(—)01”,“address_(—)02”, “city”, “state”, etc.). In some embodiments, theglobal_address table 3090 may link to other tables such as lookuptables. For example, the global_address table 3090 may link to thegeo_code table 3099, the country table 3094, and/or the zip_code table3098. The lookup tables 3094, 3098, 3099 may, for example, containdescriptions and/or other information associated with various codesand/or identifiers (e.g., “country_id”, zip_code_id”, and “geo_code_id”,respectively) stored within the global_address table 3090. In someembodiments, the various identifier fields may be related to addressand/or location information stored within the global_address table 3090(e.g., “zip_code_id” may be related to a zip code associated with one ormore addresses, etc.).

In some embodiments, the global_address table 3090 may be linked to oneor more alternate address tables such as the alternate_person_addresstable 3092 and/or the alternate_org_address table 3096. The alternateaddress tables 3092, 3096 may, for example, contain informationassociating a person and/or an organization with more than one addressstored within the global_address table 3090. If a person and/or anorganization has different billing and shipping addresses, a seasonaladdress, a temporary address, and/or an address associated with a branchoffice, alias, and/or associated entity, for example, such informationmay be represented by a record in one of the alternate address tables3092, 3096.

In some embodiments, the global_address table 3090 may also oralternatively be linked to the aggregator table 3028. Aggregation (e.g.,that is performed by the information gathering device 210, 410, 610,1510) may, according to some embodiments, be based at least in part onlocation information. For example, information may be aggregated basedon geographic relevancy and/or scope. In some embodiments, a softwareprogram and/or other aggregator may, for example, aggregate informationrelating to a specific region, state, area, and/or other location-baseddescriptor. The aggregator table 3028 may store, for example, fieldsrelating to the attributes of a specific aggregator (e.g.,“aggregator_name”, “aggregator_start_date”, etc.). According to someembodiments, an aggregator may be associated with one or more addressesand/or other locations by linking the aggregator information stored inthe aggregator table 3028 to the global_address table 3090 (e.g., viathe “address_id” field).

According to some embodiments, the global_address table 3090 may be akey risk segment table (e.g., as described elsewhere herein). Theglobal_address table 3090, in some embodiments, may be linked to otherkey risk segment tables such as, but not limited to, the event table3064, the organization table 3040, and the publication table 3022 (e.g.,which may be an item table 1620, 1720, 1820, 2020, 2120, 2220, 2320,2720). In some embodiments, an organization may be linked to one or morespecific addresses (e.g., via the “organization_address_id” field).Similarly, an event may be associated with an address and/or otherlocation via a link between the “event_location_id” field of the eventtable 3064 and the “address_id” field of the global_address table 3090.In some embodiments, the publication table 3022 may be linked to theglobal_address table 3090 via the “address_id” field. According to someembodiments, the “address_id” linking any or all of the key risk segmenttables 3022, 3040, 3064, 3090 may be the same.

For example, a publication, an event, and an organization may all beassociated with an address. In some embodiments, the address thatassociates the event, organization, and publication may provide an easyand/or quick way to identify the relationship between the different keyrisk segments. According to some embodiments, such an association via acommon address may facilitate the identification of risk. For example,if an organization is being analyzed for risk, the association betweenthe organization and any of the event, the publication, and/or theaddress may be easily identified by the links between the respectiveaddress identifying fields. In some embodiments, the event may beassociated with a known risk for example. Any review of the organizationmay quickly identify that the risk-associated event is related (e.g.,via an address) to the organization. In such a manner, for example, arisk assessment for the organization may be performed.

Turning now to FIGS. 31-35, diagrams of exemplary database tablesaccording to some embodiments are shown. The exemplary data shown asbeing stored within the exemplary tables is provided solely for thepurpose of illustration. The various database tables and/or dataelements described herein are depicted for use in explanation, but notlimitation, of described embodiments. Different types, layouts,quantifies, and configurations of any of the database tables and/or dataelements described herein may be used without deviating from the scopeof some embodiments.

Referring to FIG. 31, a diagram of exemplary database tables 3100according to some embodiments is shown. In some embodiments, thedatabase tables 3100 may be or include database tables stored withinand/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540described herein. According to some embodiments, the database tables3100 may be stored in a data storage structure similar to any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 288, 2900, 3000 described herein. In someembodiments, the database tables 3100 may be similar in composition,configuration, and/or functionality to the similarly-named tablesdescribed above in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 27, FIG. 29,and/or FIG. 30.

In some embodiments, the database tables 3100 may include a person table3102, an alias table 3112, an item table 3120, and/or an address table3190. In some embodiments, any or all of the tables 3102, 3112, 3120,3190 may be or include key risk segment tables. According to someembodiments for example, each of the person table 3102, the item table3120, and the address table 3190 may be considered a key risk segmenttable. In some embodiments, fewer or more tables (and/or key risksegment tables) may be included with the database tables 3100.

The person table 3102 may include, according to some embodiments, a“person_id” field 3130, a “person_first” field 3132, a “person_last”field 3134, an “item_id” field 3136, and/or an “address_id” field 3138.In some embodiments, the “person_id” field 3130 may store an identifierand/or other indicator associated with a person. According to someembodiments (such as shown in FIG. 31), the “person_id” field 3130 maybe or include a unique numerical identifier for each person in the table(e.g., “100394” through “100397”). In some embodiments, the“person_first” field 3132 and/or the “person_last” field 3134 mayinclude information associated with the first and/or last names ofpersons, respectively. In some embodiments, the “item_id” field 3136and/or the “address_id” field 3138 may be or include information fieldslinking the person table 3102 to other tables (as is described infurther detail below).

According to some embodiments for example, the “item_id” field 3136 ofthe person table 3102 may link to the “item_id” field 3156 of the itemtable 3120. In some embodiments, the link may be a one-to-many link asis shown in FIG. 31. For example, the value of “10192” of the “item_id”field 3136 may link to the identical (and/or otherwise associated orcorresponding) values of “10192” within the “item_id” field 3156. Insuch a manner, for example, a person (e.g., “Andy Aliore”) may beassociated with one or more items. In some embodiments, the item table3120 may include the “item_id” field 3156, an “item_type” field 3158,and/or an “item_headline” field 3160. The “item_id” field 3156 may,according to some embodiments, be configured similarly to the “item_id”field 3136 described above in relation to the person table 3102.

In some embodiments, the “item_type” field 3158 may store informationrelating to the type of item referenced by the “item_id” field 3156.According to some embodiments, the “item_type” field 3158 may storeinformation associated with various items linked to a person (e.g.,relating “Andy Aliore” to an article, a list, and/or a criminal record).The “item_headline” field 3160 may, according to some embodiments, storethe headline, title, summary information, abstract information, and/orother information associated with the items stored in the item table3120.

In some embodiments, the association between the person and the itemsmay facilitate the identification of risk. For example, the structureand arrangement of the tables 3102, 3120 and the links there between mayallow easy and/or quick identification of the article, OFAC list, and/orconviction record related to the person “Andy Aliore”. The associateditems may, for example, describe risk-related information associatedwith the person. In such a manner, the person may be easily identifiedas being associated with risk (e.g., “Andy Aliore” appears to be ahigh-profile individual with at least one conviction and having takenpart in other suspect activities).

According to some embodiments, the “address_id” field 3138 of the persontable 3102 may link to the “address_id” field 3148 of the address table3190. In some embodiments, either or both of the “address_id” fields3138, 3148 may be or include an identifier (e.g., a numeric identifier)that corresponds to and/or is otherwise associated with an address orother location. For example, the numerical identifier “73” stored withthe “address_id” fields 3138, 3148 may be a unique key within theaddress table 3190. According to some embodiments, the identifier mayreference detailed address and/or location information stored within theaddress table 3190. The address table 3190 may include, for example, an“address” field 3150, a “city” field 3152, and/or a “state” field 3154.In some embodiments (such as shown in FIG. 31), the fields 3148, 3150,3152, 3154 of the address table 3190 may contain information associatedwith one or more postal addresses.

In some embodiments, an address may be associated with a person. Forexample, the numerical identifier “73” stored in the “address_id” fields3138, 3148 may associate the person “Andy Aliore” with the address “3High St., Ablan, Okla.”. In some embodiments, such an association may beimportant for identifying risk. Assume for example that a financialtransaction involving a person named “Frita Jane” is being processed. Byaccessing and/or searching through the database tables 3100, a user mayquickly and/or easily identify that “Frita Jane” is associated with theaddress “3 High St., Ablan, Okla.”.

Further, because “Andy Aliore” is also linked to and/or associated withthe same address, a relationship between “Andy Aliore” and “Frita Jane”.Because “Andy Aliore” may be known to be associated with risk (e.g., asevidenced by his associations with the various risk-related items storedin the item table 3120), it may be assumed, inferred, and/or determined,according to some embodiments, that “Frita Jane” is also associated withrisk. In some embodiments, such as where a risk score is determined, theindirect nature of the association of “Frita Jane” with risk may bereflected in any determined score (e.g., she may not be associated withas much risk as “Andy Aliore”). In some embodiments (such as describedelsewhere herein), an action, such as denying the financial transaction,may be selected and/or otherwise determined based upon the findingsrelating to “Frita Jane”.

In some embodiments, the person table 3102 may also or alternatively belinked to the alias table 3112. In some embodiments, the alias table3112 may include an “alias_id” field 3140, a “person_id” field 3142, a“alias first” field 3144, and/or an “alias_last” field 3146. Accordingto some embodiments, the “person_id” field 3130 of the person table 3102may be linked to the “person_id” field 3142 of the alias table 3112. Insuch a manner for example, a person may be linked with one or morealiases (e.g., alternate and/or otherwise associated names). Suchassociations may be important, according to some embodiments, in theprocess of identifying risk. Where “Ohmali Smith” is known to beassociated with risk (e.g., because he is an elected official), forexample, the association with the alias name “Fred Ohmali” may beimportant in determining whether a transaction involving “Fred Ohmali”is associated with risk or not.

Turning now to FIG. 32, a diagram of exemplary database tables 3200according to some embodiments is shown. In some embodiments, thedatabase tables 3200 may be or include database tables stored withinand/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540described herein. According to some embodiments, the database tables3200 may be stored in a data storage structure similar to any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 288, 2900, 3000 described herein. In someembodiments, the database tables 3200 may be similar in composition,configuration, and/or functionality to the similarly-named tablesdescribed above in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 27, FIG. 29,FIG. 30, and/or FIG. 31.

In some embodiments, the database tables 3200 may include an item table3220, an event table 3264, a publication table 3222, and/or arelationship table 3276. In some embodiments, any or all of the tables3220, 3222, 3264, 3276 may be or include key risk segment tables.According to some embodiments for example, each of the item table 3220,the publication table 3222, the event table 3264, and the relationshiptable 3276 may be considered a key risk segment table. In someembodiments, fewer or more tables (and/or key risk segment tables) maybe included with the database tables 3200.

The item table 3220 may include an “item_id” field 3230, an “item_type”field 3232, a “publication_id” field 3234, and/or an “item_date” field3236. In some embodiments, the “item_id” field 3230 may store anidentifier and/or other indicator associated with an item. According tosome embodiments (such as shown in FIG. 31), the “item_id” field 3230may be or include a unique numerical identifier for each item in thetable (e.g., “12” through “14”). In some embodiments, the “item_type”field 3232 and/or the “item_date” field 3236 may include informationassociated with the various attributes of an item such as a typeassociated with an item and a date associated with an item,respectively. In some embodiments, the “publication_id” field 3234 maybe or include an information field linking the item table 3222 to othertables (as is described in further detail below).

In some embodiments for example, the event table 3264 may include an“event_id” field 3238, and “item_id” field 3240, and/or an “event_name”field 3242. According to some embodiments, the item table 3220 may belinked to the event table 3264 via the “item_id” fields 3230, 3240. Forexample, the item identified by the numeral “12” stored in the “item_id”field 3230 may be linked to the event identified by the numeral “3241”stored in the “event_id” field 3238, and corresponding to the numeral“12” of the “item_id” field 3240 in the event table 3264. Theassociation may represent, for example, a mention and/or description ofthe “Election fraud in Country X” (e.g., the event identified within theevent table 3264) in the “U.N. Report” (e.g., the item identified withinthe item table 3220). In some embodiments, the event may be associatedwith more than one record in the event table 3264 (as shown in FIG. 32).Other items and/or articles may mention, describe, and/or otherwiserelate to the “Country X Election”, for example.

According to some embodiments, the item table 3220 may also oralternatively link to the publication table 3222. In some embodiments,the publication table 3222 may contain more detailed informationregarding items that are publications. For example, the publicationtable 3222 may include a “publication_id” field 3244, a “publisher”field 3246, and/or a “pre_filter” field 3248. In some embodiments, the“publication_id” field 3244 may include an identifier associated with apublication. The “publication_id” field 3244 may, according to someembodiments, be or include a key such as a primary key, for example. Insome embodiments, the “publisher” field 3246 may include informationassociated with the publisher (or publishers) of any given publication.The “pre_filter” field 3248 may, according to some embodiments, includeinformation associated with one or more filtering (or other) operations(e.g., that may have been conducted by the information relevancy engine220, 420, 620, 720, 920 and/or by the information redundancy engine 230,730, 930, 1030, 1230, 1530).

In embodiments where the item table 3220 links to the publication table3222, the link may be, for example, a many-to-one link between the“publication_id” field 3234 of the item table 3220 and the“publication_id” field 3244 of the publication table 3222. For example,any items associated with the identifier “1000394” stored within the“publication_id” field 3234 of the item table 3220 may be linked to therecord in the publication table 3222 associated with the same identifier(e.g., in the “publication_id” field 3244). The “U.N. Report”, forexample, may have been published by the “M&M Co.” publisher, and/or mayhave been filtered (e.g., for relevancy, redundancy, etc.).

According to some embodiments, the event table 3264 may be linked to therelationship table 3276. The relationship table 3276 may include, forexample, a “relationship_event_to_event_id” field 3250, a“relationship_type” field 3252, an “event_id_(—)01” field 3254, and/oran “event_id_(—)02” field 3256. In some embodiments, relationship table3276 may link and/or otherwise associate two or more events within theevent table 3264. For example, the “event_id” field 3238 of the eventtable 3264 may link to the “event_id” fields 3254, 3256 of therelationship table 3276. The event associated with the identifier “3241”(e.g., as discussed above) may be linked, for example, to the eventassociated with the identifier “4932”, via the “event_id_(—)01” field3254 and the “event_id_(—)02” field 3256 of the relationship table 3276.

Turning now to FIG. 33, a diagram of exemplary database tables 3300according to some embodiments is shown. In some embodiments, thedatabase tables 3300 may be or include database tables stored withinand/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540described herein. According to some embodiments, the database tables3300 may be stored in a data storage structure similar to any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 288, 2900, 3000 described herein. In someembodiments, the database tables 3300 may be similar in composition,configuration, and/or functionality to the similarly-named tablesdescribed above in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 27, FIG. 29,FIG. 30, FIG. 31, and/or FIG. 32.

In some embodiments, the database tables 3300 may include anorganization table 3340, an alias table 3346, a person table 3302,and/or a relationship table 3366. In some embodiments, any or all of thetables 3302, 3340, 3346, 3366 may be or include key risk segment tables.According to some embodiments for example, each of the organizationtable 3340 and the person table 3302 may be considered a key risksegment table. In some embodiments, fewer or more tables (and/or keyrisk segment tables) may be included with the database tables 3300.

The organization table 3340 may include, according to some embodiments,an “organization_id” field 3310, an “organization_name” field 3312,and/or a “place_of_incorporation” field 3314. In some embodiments, the“organization_id” field 3310 may store an identifier and/or otherindicator associated with an organization and/or other entity. Accordingto some embodiments (such as shown in FIG. 33), the “organization_id”field 3310 may be or include a unique numerical identifier for eachorganization in the table (e.g., “2001-345”, “2001-092”, etc.). In someembodiments, the “organization_name” field 3312 and/or the“place_of_incorporation” field 3314 may include information associatedwith the various attributes of an organization such as a name associatedwith an organization and a place of incorporation associated with anorganization, respectively. In some embodiments, the “organization_id”field 3310 may be or include an information field linking theorganization table 3340 to other tables (as is described in furtherdetail below).

For example, the organization table 3340 may link to the alias table3346. In some embodiments, the alias table 3346 may include an“alias_org_id” field 3316, an “organization_id” field 3318, and/or an“alias_organization_name” field 3320. According to some embodiments, the“organization_id” field 3310 of the organization table 3340 may link tothe “organization_id” field 3318 of the alias table 3346 (e.g., via aone-to-many association). Through such a link for example, it may beeasily and/or quickly determined that the organization associated withthe identifier “2001-345” (e.g., “J&J Holdings”) is somehow associatedwith an undesirable organization (e.g., the “Anti-America Brigade”).

In some embodiments, the relationship table 3366 may be linked to theperson table 3302. The person table 3302 may, for example, include a“person_id” field 3322 and/or a “person_name” field 3324. In someembodiments, the relationship table 3366 may include a“relationship_person_to_org” field 3326, a “relationship_type” field3328, an “org_id” field 3330, and/or a “person_id” field 3332. Accordingto some embodiments, the “person_id” field 3322 of the person table 3302may link to the “person_id” field 3332 of the relationship table 3366.In some embodiments, either or both of the “person_id” fields 3322, 3332may be or include unique alpha-numeric identifiers (e.g., “435-A”,“002-F”, etc.). In some embodiments, the link between the person tablemay show that the person associated with the identifier “435-A” (e.g.,“Bobby Patriot”) is somehow connected with the organization associatedwith the identifier “2001-345” (e.g., “J&J Holdings”).

According to some embodiments, the arrangement of the database tables3300 and/or the configuration of the links there between may facilitatethe identification of risk. For example, assume an individual identifiedby the name “Bobby Patriot” arrives at an international airport insidethe United States and seeks to gain entry (e.g., via customs) into thecountry. Any user having access to the database tables 3300, such as acustoms officer for example, may enter the name (e.g., via anypracticable type of interface) “Bobby Patriot” to analyze the name (andhence the individual) for risk.

The configuration of the database tables 3300 and/or the links betweenthe various tables 3302, 3340, 3346, 3366 may allow the user, accordingto some embodiments, to quickly and/or easily identify that “BobbyPatriot” is associated with the “J&J Holding” organization. Further,because of the alias associated with “J&J Holding”, it may be quicklyrecognized that “Bobby Patriot” may be a supporter (e.g., from the“relationship_type” field 3328) of the suspect group called the“Anti-America Brigade”. In some embodiments, the individual named “BobbyPatriot” may accordingly, for example, be denied entry into the country,taken into custody, and/or further investigated.

Referring now to FIG. 34, a diagram of exemplary database tables 3400according to some embodiments is shown. In some embodiments, thedatabase tables 3400 may be or include database tables stored withinand/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540described herein. According to some embodiments, the database tables3300 may be stored in a data storage structure similar to any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 288, 2900, 3000 described herein. In someembodiments, the database tables 3400 may be similar in composition,configuration, and/or functionality to the similarly-named tablesdescribed above in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 27, FIG. 29,FIG. 30, FIG. 31, FIG. 32, and/or FIG. 33.

In some embodiments, the database tables 3400 may include an event table3464, a person table 3402, a relation_person_to_event table 3462, and/ora relation_person_to_person table 3468. In some embodiments, any or allof the tables 3402, 3462, 3464, 3468 may be or include key risk segmenttables. According to some embodiments for example, each of the eventtable 3464 and the person table 3402 may be considered a key risksegment table. In some embodiments, fewer or more tables (and/or keyrisk segment tables) may be included with the database tables 3400.

The event table 3464 may include, according to some embodiments, an“event_id” field 3430 and/or an “event_name” field 3432. In someembodiments, the “event_id” field 3430 may store an identifier and/orother indicator associated with an event. According to some embodiments(such as shown in FIG. 34), the “event_id” field 3430 may be or includea unique numerical identifier for each event in the table (e.g.,“00-0194” through “00-0394”). In some embodiments, the “event_name”field 3432 may include information associated with the name associatedwith an event. In some embodiments, the “event_id” field 3430 may be orinclude an information field linking the event table 3464 to othertables (as is described in further detail below).

For example, the event table 3464 may link to therelation_person_to_event table 3462. In some embodiments, therelation_person_to_event table 3462 may include an“relationship_person_to_event” field 3434, a “relationship_type” field3436, an “event_id” field 3438, and/or a “person_id” field 3440.According to some embodiments, the “event_id” field 3430 of the eventtable 3464 may link to the “event_id” field 3438 of therelation_person_to_event table 3462. In some embodiments for example,the event associated with the identifier “00-0394” of the “event_id”field 3430 in the event table 3464 may be linked to the correspondingrecords associated with the same identifier in the “event_id” field 3438in the relation_person_to_event table 3462.

In some embodiments, the link between the event table 3464 and therelation_person_to_event table 3462 may associate one or more eventswith one or more individuals. As shown in FIG. 34 for example, the eventassociated with the identifier “00-0394” is shown as being related topersons having “person_id” field 3440 values of “1159” and “1245”. Sucha link and/or association may, for example, promote the easy and/orquick identification of relationships between persons and events. In theexemplary data presented in FIG. 34 for example, “The Ud Marriage” isassociated with two participants (represented by “person_id” field 3440identifiers “1159” and “1245”).

According to some embodiments, more information may be related and/orlinked to the information presented in the relation_person_to_eventtable 3462. The relation_person_to_event table 3462 may link, forexample, to the person table 3402. The person table 3402 may include, insome embodiments, a “person_id” field 3442, a “person_name” field 3444,and/or an “occupation” field 3446. The “person_name” field 3444 and the“occupation” field 3446 may, for example, contain information relatingto the name and occupation of an individual, respectively. In someembodiments, the “person_id” field 3440 of the relation_person_to_eventtable 3462 may link to the “person_id” field 3442 of the person table3402. In some embodiments, the persons described as “participants” in“The Ud Wedding” may thus easily be identified as “Mary Jones” and“Mahma Al Ud”.

According to some embodiments, additional and/or complementaryinformation (e.g., with respect to the information stored in the eventtable 3464, the relationship_person_to_event table 3462, and/or theperson table 3402) may be stored in the relation_person_to_person table3468. The relation_person_to_person table 3468 may include, for example,a “relationship_person_to_person_id” field 3448, a “relationship_type”field 3450, a “person_id_(—)01” field 3452, and/or a “person_id_(—)02”field 3456. In some embodiments, the person table 3402 may link, forexample, to the relation_person_to_person table 3468 (e.g., via the“person_id” fields 3442, 3452, 3456).

In some embodiments, the relation_person_to_person table 3468 mayassociate two or more individuals from the person table 3402. Forexample, the two individuals noted above as having been “participants”at “The Ud Wedding” may be associated via a record in therelation_person_to_person table 3468. In some embodiments, the recordmay indicate (e.g., via the “relationship_type” field 3450) that the twoindividuals (identified as “1159” and “1245”) are associated as spouses.In some embodiments, a person may be associated with multiple records inthe relation_person_to_person table 3468 (e.g., relating the person tomultiple other persons having various relationship types).

According to some embodiments, the links and/or associations between thedatabase tables 3400 may facilitate the identification of risk. Assumefor example that a National Security Agency (NSA) analyst by the name of“Mary Jones” attempts to gain clearance to access certain sensitivedocuments. Access to the database tables 3400 may, in some embodiments,allow a user (e.g., a supervisor, a researcher, etc.) to quickly and/oreasily identify that “Mary Jones” is and/or was likely married to anindividual named “Mahma Al Ud”. In some embodiments, such as where“Mahma Al Ud” is known to be associated with risk (e.g., may be an armsdealer, politician, etc.), “Mary Jones” may be determined to beassociated with risk. According to some embodiments, the clearance togain access to the sensitive documents may be denied based upon the riskassociated with “Mary Jones”.

Turning now to FIG. 35, a diagram of exemplary database tables 3500according to some embodiments is shown. In some embodiments, thedatabase tables 3500 may be or include database tables stored withinand/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540described herein. According to some embodiments, the database tables3500 may be stored in a data storage structure similar to any of thedata storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300,2400, 2500, 2600, 2700, 288, 2900, 3000 described herein. In someembodiments, the database tables 3500 may be similar in composition,configuration, and/or functionality to the similarly-named tablesdescribed above in conjunction with any of FIG. 16, FIG. 17, FIG. 18,FIG. 19, FIG. 20, FIG. 21, FIG. 22, FIG. 23, FIG. 24, FIG. 27, FIG. 29,FIG. 30, FIG. 31, FIG. 32, FIG. 33, and/or FIG. 34.

In some embodiments, the database tables 3500 may include an event table3564, a person table 3502, an organization table 3540, a publicationtable 3522, and/or an address table 3590. In some embodiments, any orall of the tables 3502, 3522, 3540, 3564, 3590 may be or include keyrisk segment tables. According to some embodiments for example, each ofthe tables 3502, 3522, 3540, 3564, 3590 may be considered a key risksegment table. In some embodiments, fewer or more tables (and/or keyrisk segment tables) may be included with the database tables 3500.

The event table 3564 may include, according to some embodiments, an“event id” field 3510, an “event_name” field 3512, and/or an“event_location_id” field 3514. The publication table 3522 may include,for example, a “publication_id” field 3516, a “pub_name” field 3518,and/or an “address_id” field 3520. In some embodiments, the person table3502 may include a “person_id” field 3530, a “person_name” field 3532,and/or an “address_id” field 3534. The organization table 3540 mayinclude, according to some embodiments, an “organization_id” field 3570,an “organization_name” field 3572, and/or and “address_id” field 3574.The address table 3590 may include, for example, an “address_id” field3550, and “address” field 3552, a “city” field 3554, a “state” field3556, and/or a “country” field 3558. In some embodiments, the fields3510, 3512, 3514, 3516, 3518, 3520, 3530, 3532, 3534, 3550, 3552, 3554,3556, 3558, 3570, 3572, 3574 of the database tables 3500 may be similarin composition, configuration, and/or functionality to thesimilarly-named fields described in any of FIG. 31, FIG. 32, FIG. 33,and/or FIG. 34 above.

In some embodiments, the address table 3590 may link to any or all ofthe other tables 3502, 3522, 3540, 3564. For example, the address table3590 may link to each of the other tables 3502, 3522, 3540, 3564 via the“address_id” field 3550 of the address table 3590. In some embodiments,any or all of the links may be, for example, many-to-many links (e.g.,multiple addresses may be associated with a person and/or multiplepersons may be associated with a single address). According to someembodiments, fewer or more tables and/or links than are shown inconjunction with FIG. 35 may be utilized without deviating from someembodiments.

According to some embodiments, the database tables 3500, the links therebetween, and/or the fields therein may facilitate the identification ofrisk. Users may, for example, query information relating to a specificaddress (e.g., “1234 Ave. L, Ogdens, ON”) in relation to a real estatepurchase, a foreclosure, a property seizure, and/or any otherpracticable reason. The “address_id” field 3550 value associated withthe desired address (e.g., “90213”) may, for example, link to variousrelated fields 3514, 3520, 3534, 3574 in the other tables 3502, 3522,3540, 3564. In some embodiments, the links between the database tables3500 may allow, for example, a user to quickly and/or easily identifythat the address is related to and/or otherwise associated with an event(e.g., a “Government Scandal”), a publication (e.g., the “Red CityCrier”), a person (e.g., “Maria Bluhil”), and an organization (e.g.,“Greenwater, Inc.”). In some embodiments, the risk associated with anyof the various related entities may be analyzed to determine any riskthat may be associated with the address being investigated.

Information Matching Engine

Turning now to FIG. 36, a block diagram of a system 3600 according tosome embodiments is shown. In some embodiments, the system 3600 may beused to implement or perform the methods 300, 500, 800, 1100, 1400and/or may otherwise be associated with the methods 300, 500, 800, 1100,1400 (or any portions thereof) as described in conjunction with any ofFIG. 3, FIG. 5, FIG. 8, FIG. 11, and/or FIG. 14 above. The system 3600may, for example, be similar in configuration and/or functionality tothe information matching engine 250, 1350, 1550 (or the risk server 102,202) and/or may perform in accordance with the procedure 314 asdescribed above in conjunction with FIG. 3.

The system 3600 may, for example, include a user device 3606, a databasesystem 3640 and/or an information matching engine 3650. In someembodiments, the information matching engine 3650 may include a namematching device 3652 and/or an identity matching device 3654. The system3600 may, according to some embodiments, also or alternatively includean information delivery engine 3660. In some embodiments, the components3606, 3640, 3650, 3660 of system 3600 may be similar in configurationand/or functionality to the similarly-named components described inconjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6, FIG. 10, FIG.12, FIG. 13, and/or FIG. 15 above.

In some embodiments, it may be desirable to compare a certain piece ofinformation to information stored within and/or by the database system3640. For example, a user may desire to evaluate a piece of informationfor risk by comparing the piece of information to stored risk-relevantinformation. In some embodiments, a user may send a query, for example,to the information matching engine 3650. According to some embodiments,such a query may be sent directly from the user device 3606 to theinformation matching engine 3650. In some embodiments, the query may besent through and/or using the information delivery engine 3660.

The query sent by the user (e.g., from the user device 3606) mayinclude, according to some embodiments, a name of an organization,person, event, address, and/or other entity or object that is to beevaluated for risk. The name and/or the query may be sent, for example,to the name matching device 3652 of the information matching engine3650. In some embodiments, the name matching device 3652 may compare thename and/or the query to information stored within and/or by thedatabase system 3640. The comparison may involve, for example, searchingfor identical and/or similar names within the database system 3640.

In some embodiments, the name and/or the query may be matched with oneor more records within a database (not shown in FIG. 36). According tosome embodiments, the identified records from the database (and/or thename and/or query) may be sent to the identity matching device 3654. Theidentity matching device 3654 may, for example, further compare the nameand/or the query to the identified (e.g., matching or potentiallymatching) records. In some embodiments, the identity matching device3654 may compare various attributes, relations, and/or other informationrelating to each of the name and/or query and the identified records.According to some embodiments, information associated with the nameand/or the query may be compared to similar information associated withthe identified records.

In some embodiments, if the identity matching device 3654 determinesthat one or more records were inappropriately and/or mistakenly matchedto the name and/or query, those records may be filtered out, discarded,and/or otherwise ignored (e.g., not included in a result set of recordsbelieved to match the name and/or query). According to some embodiments,any records determined (e.g., with some degree of probability) to berelated to, identical to, and/or otherwise associated with the nameand/or query may be sent to the information delivery engine 3660. Theinformation delivery engine 3660 may, for example, format the resultsand deliver them to the user device 3606. In some embodiments, the queryresult information (e.g., the matched records from the database) may besent and/or otherwise provided directly from the identity matchingdevice 3654 and/or the information matching engine 3650 to the userdevice 3606.

In FIG. 37, a method 3700 according to some embodiments is shown. Insome embodiments, the method 3700 may be conducted by and/or byutilizing any of the systems 100, 200, 400, 600, 700, 900, 1000, 1200,1300, 1500 described above and/or may be otherwise associated with anyof the systems 100, 200, 400, 600, 700, 900, 1000, 1200, 1300, 1500and/or any of the system components (e.g., the information matchingengine 250, 1350, 1550, 3650) described in conjunction with any of FIG.1, FIG. 2, FIG. 4, FIG. 6, FIG. 7, FIG. 9, FIG. 10, FIG. 12, FIG. 13,and/or FIG. 15 above. In some embodiments, the method 3700 may be orinclude a portion of and/or a procedure within other methods such asmethod 300 described above.

In some embodiments, the method 3700 may begin at 3702 by receiving aname. For example, the information matching engine 3650 may receive thename from the information delivery engine 3660 and/or a user device3606. In some embodiments, the name may be or include and/or otherwisebe associated with a query. The query may be, for example, a riskevaluation query performed for due diligence purposes. In someembodiments, information indicative of the name may be received.Multiple names and/or other pieces of information may also oralternatively be received.

The method 3700 may continue, at 3704 for example, by comparing the nameto stored information. The stored information may be or include, forexample, information associated with risk. In some embodiments, thestored information may be stored in and/or by the database system 3640.According to some embodiments, the stored information may be maintainedand/or otherwise located in a data storage structure that is configuredto facilitate the identification of risk (e.g., any of the data storagestructures 1600, 1700, 1800, 1900, 2000, 2100, 2200, 2300, 2400, 2500,2600, 2700, 2800, 2900, 3000 described herein). In some embodiments, thename may be compared to other names that are stored, for example, in adatabase. According to some embodiments, each letter and/or character inthe name may be compared to various characters and/or letters containedwithin certain fields of stored information.

In some embodiments, the method 3700 may continue by determining if thename matches any of the stored information, at 3706. For example, if astored name and/or other stored information is identical to the receivedname, then a match may occur. In some embodiments, entire names (e.g.,first, last, middle, etc.) may be compared to determine if a matchexists. According to some embodiments, variations of the received namemay be compared to the stored names and/or other information todetermine if a match exists.

Spelling variations of the received name may, for example, be checkedagainst stored names and/or information to determine if a match exists.In some embodiments, certain spelling variations such as language,cultural, and/or formality variations may be identified for comparisonand matching purposes. In some embodiments, associated names such asnicknames, maiden names, and/or other variations may be checked.According to some embodiments, the name matching device 3652 of the namematching engine 3650 may conduct, perform, and/or manage thedetermination of matched names and/or other information.

The method 3700 may continue at 3708, according to some embodiments, bydetermining if a match between the received name and any storedinformation is correct. The determining may include, for example,verifying any match determined at 3706. In some embodiments, thereceived name and any information determined to match the received namemay be further compared and/or evaluated to determine if the match wascorrectly identified. For example, where a name is compared to storednames and matching database records are identified, other fields of thedatabase records may be compared to information associated with thereceived name. In some embodiments, if the compared fields also aredetermined to match, then the match may be verified and/or maintained.

If the compared fields fail to match, then the match between thereceived name and the stored information may be discarded and/orotherwise ignored. In some embodiments, each and/or every comparisonbetween the received name and the stored information may be scored todetermine if a match exists. Each matching field, attribute, and/orrelation may, for example, by scored and/or weighed based on alikelihood of matching (e.g., the score may be associated with aprobability of a match existing). In some embodiments, the scores may beadded, averaged, and/or otherwise manipulated to determine an overall ortotal score or rank associated with a match. If the score or rankexceeds a pre-determined value, according to some embodiments, then thematch may be verified to exist. In some embodiments, the identitymatching device 3654 of the information matching engine 3650 mayconduct, perform, and/or manage the verification of matched names and/orother information.

In some embodiments, the method 3700 may include fewer or moreprocedures and/or processes than are shown in FIG. 37. For example, oncea match is determined and/or verified (e.g., at 3706 and/or 3708), thematch information may be provided to a user. Where the name was providedas part of a user query, for example, the match information may beprovided to the user as query results. In some embodiments, the matchingmay be conducted specifically to identify risk. According to someembodiments, the identification of matching stored information mayinclude comparing certain fields and/or tables that are deemed importantfor identifying risk (e.g., key risk segment tables, metrics, fields,etc.). In some embodiments, the links between various database tablessuch as between various key risk segment tables, may be compared and/orotherwise analyzed to assist in determining if name and/or otherinformation matches exist.

Turning now to FIG. 38, a block diagram of a system 3800 according tosome embodiments is shown. In some embodiments, the system 3800 may beused to implement or perform and/or may otherwise be associated with themethods 300, 500, 800, 1100, 1400, 3700 (or any portions thereof) asdescribed in conjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11,FIG. 14, and/or FIG. 37 above. The system 3800 may, according to someembodiments, be similar in configuration and/or functionality to thesystem 3600 described above.

The system 3800 may, for example, include a user device 3806, a databasesystem 3840 and an information matching engine 3850. The informationmatching engine 3850 may include, for example, a name matching device3852 and/or an identity matching device 3854. In some embodiments, thename matching device 3852 may include a cultural variation device 3852a, a pre-defined variation device 3852 b, a language variation device3852 c, and/or a naming convention device 3852 d. According to someembodiments, the identity matching device 3854 may include amultiple-field comparison device 3854 a and/or a duplicate result filter3854 b. The system 3800 may also or alternatively include an informationdelivery engine 3860 and/or one or more information paths 3890. In someembodiments, the components 3806, 3840, 3850, 3852, 3854, 3860 of system3800 may be similar in configuration and/or functionality to thesimilarly-named components described in conjunction with any of FIG. 1,FIG. 2, FIG. 4, FIG. 6, FIG. 10, FIG. 12, FIG. 13, FIG. 15, and/or FIG.36 above.

In some embodiments, a query, request, name, and/or other informationmay be received by the information matching engine 3850. The query maybe sent, for example, by the user device 3806 to the name matchingdevice 3852 via the information path 3890 a. In some embodiments, thequery or other information may be sent by the user device 3806 to theinformation delivery engine 3860 via the information path 3890 b. Theinformation delivery engine 3860 may then, for example, forward thequery further along the information path 3890 b to the name matchingengine 3852. According to some embodiments, the information deliveryengine 3860 may broker information between the user device 3806 and theinformation matching engine 3850.

In some embodiments, the name matching device 3852 may analyze thereceived information (e.g., the query and/or name received from the userdevice 3806) to determine likely variations of the received information.Where the received information includes a name such as “Al von Cru”, forexample, the name matching device 3852 may utilize any or all of thecultural variation device 3852 a, the pre-defined variation device 3852b, the language variation device 3852 c, and the naming conventiondevice 3852 d to determine variations of the name. The culturalvariation device 3852 a may, according to some embodiments, determineand/or identify one or more cultural variations that may be associatedwith the name. For example, the cultural variation device 3852 a maydetermine that in some and/or certain cultures, the first name “Al” maybe shorthand for “Alfonzo”. In some cultures, the first name may bewritten last, while the surname may be written first. Accordingly, thecultural variation device 3852 a may identify “Al” as a potential lastname and/or “Cru” or “von Cru” as a potential first name.

According to some embodiments, the pre-defined variation device 3852 bmay analyze the name to determine if it satisfies any rules that havebeen previously defined. For example, the pre-defined variation device3852 b may include instructions that are intended to identify spellingerror variations of a name. The first name “Al”, for example, may benoted to often be misspelled and/or incorrectly entered into datasystems as “A1” (i.e., the letter “A” plus the numeral one). Thepre-defined variation device 3852 b may accordingly determine that thename (or portion of the full received name) corresponds to a pre-definedrule. In some embodiments, the pre-defined variation device 3852 b maythen identify the potential alternate and/or incorrect spelling of thename.

In some embodiments, the language variation device 3852 c may also oralternatively analyze the received name. For example, the languagevariation device 3852 c may determine various linguistic variants likelyto be associated with the name. In some languages for example, the name(or a portion thereof) may be written differently than in the Englishlanguage. The last name “Cru”, for example, may be written as “Crue”,“Croo”, “Czuth”, and/or other variants. In some embodiments, anypotential and/or likely linguistic variations of the name may beidentified by the language variation device 3852 c.

The naming convention device 3852 d may, according to some embodiments,analyze the received name for potential naming convention variants. Thenaming convention device 3852 d may, for example, determine variousnicknames, common alias names, and/or other formal and/or stylisticvariations of the name. The name “Al von Cru”, for example, mayalternately by written as “Al de Cru”, “Al el Cru”, and/or in accordancewith other conventions that may deviate from the form in which the namewas received. In some embodiments, one or more such variations may beidentified by the naming convention device 3852 d.

According to some embodiments, the various potential variationsidentified by the name matching device 3852 and/or by one or more of itscomponents 3852 a-d may be used to determine if associated informationis stored in and/or by the database system 3840. The name matchingdevice 3840 may, for example, search one or more databases (not shown inFIG. 38) of the database system 3840 for each variation of the receivedname. In some embodiments, database records having names that match anyof the variants may be identified. According to some embodiments, storednames that are similar and/or otherwise likely to be associated with thereceived name may also or alternatively be identified.

The name matching device 3852 may, according to some embodiments, send aquery via the information path 3890 c to the database system 3840. Thequery may include, for example, each of the variants identified as beingassociated (or likely to be associated) with the received name. In someembodiments, the database system may return a result set of identifieddatabase records back to the name matching device 3852 (e.g., via theinformation path 3890 c). The name matching device 3852 may then, forexample, forward the result set to the identity matching device 3854 viathe information path 3890 d.

The identity matching device 3854 may, according to some embodiments,utilize either or both of the multiple-field comparison device 3854 aand the duplicate result filter device 3854 b to analyze the result set.In some embodiments, the result set may be provided directly by thedatabase system 3840 to the identity matching device 3854 via theinformation path 3890 e. According to some embodiments, themultiple-field comparison device 3854 a may compare various attributes,fields, relations, and/or other information associated with the receivedname and/or the matching records from the results set.

For example, the multiple-field comparison device 3854 a may access thedatabase system 3840 (e.g., via the information path 3890 e) todetermine various fields of information associated with a databaserecord of the result set. Continuing the example from above, thereceived name is “Al von Cru”. One of the names found in the databasethat may be related to the received name may be, for example, “AlVoncru”. The multiple-field comparison device 3854 a may query thedatabase system 3840 for other information associated with the storedname. In some embodiments for example, the query may retrievesupplemental information such as an age (e.g., “34 years”), a height(e.g., “five feet and two inches”), and/or an address (e.g., “101 JonStreet, Bermuda, W.I.”) associated with the stored name.

According to some embodiments, the identity matching device 3854 and/orthe multiple-field comparison device 3854 a may compare the supplementalinformation associated with the stored name to similar informationassociated with the received name. When the supplemental information isdetermined to match (or substantially match), the correlation betweenthe received name and the identified stored name may be deemed verified.According to some embodiments, matching across multiple fieldcomparisons may be required prior to determining that the match isgenuine (or otherwise likely to be correct). In some embodiments forexample, where the age associated with the received name “Al von Cru” is“6 years old” and the age associated with the potentially matchingstored name “Al Voncru” is “34 years old”, a match between the names maybe determined not to exist. The record for the stored name “Al Voncru”may then, for example, be removed from the result set.

In some embodiments, more fields may also or alternatively be compared.If the associated addresses are compared and determined to beequivalent, for example, then the age difference may be assumed to beattributable to different generations in the same family. Where theaddresses also do not match and/or do not appear to be otherwiserelated, then the match may be determined to be invalid. In someembodiments, every field and/or every piece of secondary informationavailable may be compared. Verification of the match may depend, forexample, on a score or rank based at least in part on the number offields and/or pieces of information that appear to match and/orotherwise be related. In some embodiments, certain fields may be knownto have more bearing upon match verification and may, for example, beweighted more heavily when determining matching scores. In someembodiments, review by an operator and/or other individual may also oralternatively be used in an attempt to verify name (and/or otherinformation) matches.

According to some embodiments, the verified result set may be further oralternatively analyzed by the duplicate result filter device 3854 b. Theduplicate result filter device 3854 b may, for example, compare variousrecords within the result set to remove duplicate information. In someembodiments, a record may only be removed if every field associated withthe record matches every field of another record. According to someembodiments, variations between fields associated with records may beanalyzed to determine if the variations are likely indicative ofdifferent information. The fields may be analyzed, for example, todetermine if variations are due to spelling and/or data entry errors, orare legitimately different pieces of information.

The identity matching device 3854 may then, for example, send theanalyzed result set to the information delivery engine 3860 via theinformation path 3890 f. The information delivery engine 3890 f may, forexample, format and/or otherwise process the information for delivery tothe user device 3806. In some embodiments, the information deliveryengine 3860 may determine an appropriate manner in which to provide theresult set to the user device 3806, and may, for example, send theinformation further along the information path 3890 f to the user device3806. In some embodiments, the identity matching device 3854 and/or theinformation matching engine 3850 may provide, forward, and/or send theinformation directly to the user device 3806 via the information path3890 g.

Information Delivery Engine

Turning now to FIG. 39, a block diagram of a system 3900 according tosome embodiments is shown. In some embodiments, the system 3900 may beused to implement or perform the methods 300, 500, 800, 1100, 1400, 3700and/or may otherwise be associated with the methods 300, 500, 800, 1100,1400, 3700 (or any portions thereof) as described in conjunction withany of FIG. 3, FIG. 5, FIG. 8, FIG. 11, FIG. 14, and/or FIG. 37 above.The system 3900 may, for example, be similar in configuration and/orfunctionality to the information delivery engine 260, 1560, 3660, 3860(or the risk server 102, 202) and/or may perform in accordance with theprocedure 314 as described above in conjunction with FIG. 3.

The system 3900 may, for example, include a user device 3906, aninformation matching engine 3950, and/or an information delivery engine3960. In some embodiments, the information delivery engine 3960 mayinclude a reporting device 3962 and/or a client interface device 3964.In some embodiments, the components 3906, 3950, 3960 of system 3900 maybe similar in configuration and/or functionality to the similarly-namedcomponents described in conjunction with any of FIG. 1, FIG. 2, FIG. 4,FIG. 6, FIG. 10, FIG. 12, FIG. 13, FIG. 15, FIG. 36, and/or FIG. 38above.

In some embodiments, the user device 3906 may submit a query associatedwith determining risk to the information delivery engine 3960. The querymay be submitted through and/or using the client interface device 3964,for example. In some embodiments, the client interface device 3964 maybe resident on, controlled by, and/or otherwise associated with the userdevice 3906. The client interface device 3964 may, according to someembodiments, be or include a web interface and/or a graphical userinterface (GUI). In some embodiments, the client interface device 3964may be configured in a client-server architecture which includes, forexample, a portion resident on a server (e.g., on the informationdelivery engine 3960) and a portion resident on the user device 3906.

The user query may, according to some embodiments, be sent to theinformation matching engine 3950 for analysis (e.g., as described abovein conjunction with FIG. 36, FIG. 37, and FIG. 38). In some embodiments,query results may be provided by the information matching engine 3950.According to some embodiments, the reporting engine 3962 may format,manage, and/or otherwise process either or both of the user query andthe query results. The reporting engine 3962 may, for example, be orinclude an application program interface (API) and/or other program thatpermits queries to be created, executed, and/or formatted into reportingdocuments. In some embodiments, the client interface device 3964 may bea part of (e.g., a front-end and/or client-side module) and/or otherwiseassociated with the reporting device 3962.

In FIG. 40, a method 4000 according to some embodiments is shown. Insome embodiments, the method 4000 may be conducted by and/or byutilizing any of the systems 100, 200, 400, 600, 700, 900, 1000, 1200,1300, 1500, 3600, 3800, 3900 described above and/or may be otherwiseassociated with any of the systems 100, 200, 400, 600, 700, 900, 1000,1200, 1300, 1500, 3600, 3800, 3900 and/or any of the system components(e.g., the information delivery engine 260, 1560, 3660, 3860, 3960)described in conjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6,FIG. 7, FIG. 9, FIG. 10, FIG. 12, FIG. 13, FIG. 15, FIG. 36, FIG. 38,and/or FIG. 39 above. In some embodiments, the method 4000 may be orinclude a portion of and/or a procedure within other methods such asmethod 300 described above.

In some embodiments, the method 4000 may begin at 4002 by receiving auser query. The user query may be or include, for example, a riskassessment query. According to some embodiments, the query may bereceived by the information delivery engine 3960 (and/or one of itscomponents 3962, 3964). In some embodiments, the query and/or dataindicative of the query may be created, compiled, and/or received via aninterface which may be provided, for example, by the client interfacedevice 3964. The interface may be associated with either or both of theuser device 3906 and the information delivery engine 3960. According tosome embodiments, the query may include and/or reference one or morenames, entities, organizations, items, persons, events, and/or otherpieces of information or objects.

The method 4000 may continue, at 4004 for example, by determining a nameto be evaluated for risk. In some embodiments, the name (or one or morenames) may be specified directly by the user query. According to someembodiments, the name may be inferred, looked-up, and/or otherwisedetermined based at least in part on the user query. In some embodimentsfor example, a user may operate and/or interact with an interface andpick the name from a list of available names. According to someembodiments, the name may be determined by analyzing, scanning, and/orotherwise processing one or more documents of interest to the user. Theuser may scan and/or fax, for example, a transaction document that maybe analyzed by the information delivery engine 3960 to determine one ormore names of potential interest (e.g., parties to the transaction).

In some embodiments, the method 4000 may continue by sending the name toan information matching device (e.g., information matching device 3950),at 4006. The name determined at 4004 may, for example, be sent,transmitted, and/or otherwise provided to the information matchingdevice 3950 to be analyzed for risk. In some embodiments, theinformation matching device 3950 may compare the name to storedinformation to identify any stored information that may be associatedwith the name. In some embodiments, the name may be evaluated for riskby the information matching device 3950.

The method 4000 may continue at 4008, according to some embodiments, byreceiving match information from the information matching device. Insome embodiments, the match information may be or include informationindicative of one or more potential and/or likely relationships betweenthe name and one or more records of stored information. The matchinformation may also or alternatively include any records from adatabase (e.g., of the database system 240, 440, 640, 1040, 1240, 1340,1540, 3640, 3840) that have been determined to match and/or otherwise beassociated with (or potentially associated with) the name. In someembodiments, the match information may be or include informationregarding any risk associated with the name. The information matchingengine 3950 may, for example, determine and/or identify risk associatedwith the name and may provide such information to the informationdelivery engine 3960.

In some embodiments, the method 4000 may continue by formatting thematch information at 4010. For example, the match information receivedat 4008 may be formatted, arranged, manipulated, aggregated, and/orotherwise processed to prepare it for delivery (e.g., to a user). Insome embodiments, the match information may be presented in a formattedreport, a list, a file, and/or in any other configuration and/or formatthat is or becomes practicable. In some embodiments, the matchinformation may be formatted based on user preferences and/or based onthe type and/or configuration of a user device.

The method 4000 may continue, for example, at 4012 by providing theformatted match information to a user device. In some embodiments, thematch information may be transmitted, uploaded, and/or otherwiseprovided to one or more user devices. According to some embodiments, thematch information provided to the user device may include riskassessment and/or identification information. The match information mayalso or alternatively include information related to one or more actionsthat should be taken (e.g., to minimize and/or reduce risk). In someembodiments, the match information may be or include informationinforming the user of a status and/or decision (e.g., a transactionassociated with the user query may have been automatically denied and/orcancelled due at least in part to risk information associated with thename).

Turning now to FIG. 41, a block diagram of a system 4100 according tosome embodiments is shown. In some embodiments, the system 4100 may beused to implement or perform and/or may otherwise be associated with themethods 300, 500, 800, 1100, 1400, 3700, 4000 (or any portions thereof)as described in conjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11,FIG. 14, FIG. 37, and/or FIG. 40 above. The system 4100 may, accordingto some embodiments, be similar in configuration and/or functionality tothe system 3900 described above.

The system 4100 may, for example, include user devices 4106 a-c, aninformation matching engine 4150, and/or an information delivery engine4160. The information delivery engine 4160 may include, for example, areporting device 4162, a client interface device 4164, a web interfacedevice 4166, a data export device 4168, and/or a billing device 4170.The system 4100 may also or alternatively include one or moreinformation paths 4192, 4194, 4196. In some embodiments, the components4106, 4150, 4162, 4164, 4160 of system 4100 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6,FIG. 10, FIG. 12, FIG. 13, FIG. 15, FIG. 36, FIG. 38, and/or FIG. 39above.

In some embodiments, the information delivery engine 4160 may receive aquery and/or other information from any or all of the user devices 4106a-c (e.g., via the information paths 4192 a-c, respectively). In someembodiments for example, one of the user devices 4106 a-c may submit aquery including the name “Bond”. According to some embodiments, thequery may be forwarded to the information matching engine 4150 via theinformation path 4192 d. The information matching engine 4150 may then,for example, process the query and/or other information (e.g., a name)to assess, determine, and/or identify risk. In some embodiments, theinformation matching engine 4150 may identify stored information thatmay be associated with the query information (e.g., informationassociated with the name “Bond”). According to some embodiments, theinformation matching engine 4150 may rend and/or otherwise provide queryresult and/or match information to the information delivery engine 4160(e.g., via the information path 4194). The query results may include,for example, stored database records relating to a “Mary Bond”, “BobBond”, “Ida Bondinski”, “Bond Corporation”, and/or any other potentiallyassociated information.

In some embodiments, the query results provided by the informationmatching engine 4150 may be received by the reporting device 4162.According to some embodiments, the reporting device 4162 may also oralternatively provide the query information to the information matchingdevice 4150 (e.g., via the information path 4192 d). The reportingengine 4162 may be used by a user and/or at the direction of a user toformulate a query for the name “Bond”, for example. In some embodiments,the query may be or include a simple SELECT statement written in theStructured Query Language (SQL) that identifies “Bond” as a parameter tosearch for in any of various name fields. The results that are to bereturned to the reporting device 4162 may, according to someembodiments, be determined, formatted, and/or specified within and/or bythe query request generated by the reporting device 4162.

According to some embodiments, the reporting device 4162 may provide thequery results (e.g., in the form of a formatted report) to the clientinterface device 4164 (e.g., via the information path 4194 a), the webinterface device 4166 (e.g., via the information path 4194 b), and/orthe data export device 4168 (e.g., via the information path 4194 c). Insome embodiments, the client interface device 4164 may be or include anyof the web interface device 4166 and/or the data export device 4168.According to some embodiments, the client interface device 4164 may beor include a GUI interface. In some embodiments, the client interfacedevice 4164 may be or include a computer-readable medium storinginstructions to allow a user to access the information delivery engine4160 and/or a database (not shown in FIG. 41).

The query result information may, in some embodiments, continue alongthe information path 4194 a from the client interface device 4164 to theuser device 4106 a. In some embodiments, the information may be providedvia the information path 4194 b to the web interface device 4166. Theweb interface device 4166 may be or include, for example, a web server,a web page and/or website, and/or a web browser. The query resultinformation may be posted, for example, on a website associated with theweb interface device 4166, which in tum may be accessed by the userdevice 4106 b (e.g., via the information path 4194 b). In someembodiments, the data export device 4168 may transfer the query resultinformation directly to the user device 1406 c (e.g., via theinformation path 4194 c). The data export device 4168 may be or include,for example, a File Transfer Protocol (FTP) server, a web browserplug-in for downloading information, and/or a computer readable mediumfor storing the query result information. The information may be storedon a Compact Disk (CD) or other recordable medium, and then may bemailed, shipped, and/or otherwise delivered, for example, to the userdevice 4106 c.

In some embodiments, the providing of the query result information(and/or other information) to the user devices 4106 a-c may involvecharging a fee for the information. According to some embodiments forexample, the billing device 4170 may monitor and/or manage the flow ofinformation and/or the billing associated with the informationproviding. In some embodiments, the billing device 4170 may communicatewith the reporting device 4162 via the information path 4196. Thebilling device 4170 may, for example, charge a user for each reportgenerated by the reporting device 4162 on behalf of the user. Thebilling device 4170 may also or alternatively manage other billingarrangements such as time of use, subscription, and/or volume billing.In some embodiments, the amount billed may be associated with theresults of the query (e.g., more may be charged for queries thatidentify risk than those that do not).

User Interfaces

Turning now to FIG. 42, a diagram of an exemplary screen display 4200according to some embodiments is shown. The screen display 4200 may beutilized in accordance with any of the systems 100, 200, 400, 600, 700,900, 1000, 1200, 1300, 1500, 3600, 3800, 3900, 4100 and/or any of themethods 300, 500, 800, 1100, 1400, 3700, 4000 described above. In someembodiments, the screen display 4200 may be presented on a user device106, 206, 1506, 3606, 3806, 3906, 4106 by a risk server 102, 202 and/orany components thereof (e.g., the information delivery engine 4160, theclient interface device 4164, etc.). The various elements 4202, 4204,4206, 4208, 4210, 4212 of the screen display 4200 may be or include anytype, quantity, and/or configuration of elements that are or becomepracticable. The screen display 4200 may, according to some embodiments,include fewer or more components and/or features than are shown in FIG.42.

The screen display 4200 may include, according to some embodiments, aquery section 4202, one or more data entry fields 4204, a query resultsection 4206, one or more query result type selection boxes 4208, aninformation display area 4210, and/or a risk code field 4212. The querysection 4202 may include, according to some embodiments, various textboxes and/or other interactive and/or informational regions that may bemanipulated by a user. For example, the data entry field titled “LastName/Business Name” 4204 may be or include a text box in which a usermay enter information associated with a name. In some embodiments, itmay be desired by a user to evaluate the name entered in the data entryfield 4204 for risk.

As shown in FIG. 42 for example, a user may enter the name of anorganization (e.g., “The Benevolence Hunger Foundation”) that is to beevaluated for risk. In some embodiments, the user may be preparing tomake a corporate charity donation to the organization for example. Otherfields may be presented (e.g., as shown and/or as is or becomespracticable) to allow a user to enter any available informationassociated with the desired risk assessment. In some embodiments, themore information that is entered with respect to a query request, forexample, the more accurate any determination and/or identification ofrisk may be.

According to some embodiments, the information entered by the user(e.g., in data entry field 4204) may be processed when the user strikesa key and/or otherwise indicates that all necessary and/or availablequery information has been entered (e.g., the user may click a “SUBMIT”button or other similar device not shown in FIG. 42). In someembodiments, results associated with the query may be displayed in thequery result section 4206. The query result section 4206 may include,for example, one or more query result type selection boxes 4208 (e.g.,the “Summary” selection box). Utilizing the selection box 4208, forexample, a user may configure how the query results will be retunedand/or displayed. Selecting the “Summary” selection box 4208 may, insome embodiments, cause summarized information associated with the queryresults to be displayed. In some embodiments (such as shown in FIG. 42),other selection boxes may be provided to cause the query results to beformatted and/or presented in different ways (e.g., the results arepresented in their entirety, as a list, a watch list, a government list,etc.).

According to some embodiments, the query results may be presented in theinformation display area 4210. Based on the information provided by theuser (e.g., in data entry field 4204), for example, any informationrelevant to the user's query may be determined and provided in theinformation display area 4210. In some embodiments, the informationpresented in the information display area 4210 may be based upon theformatting selection (and/or selections) defined by the selection box4208.

As shown in FIG. 42 for example, the selection box 4208 that is selectedis a “Summary” box. The results displayed in the information displayarea 4210 may accordingly include, in some embodiments (such as shown inFIG. 42), a summary of the information relevant to the user's query.According to some embodiments, the information display area 4210 may beutilized by a user to identify, assess, and/or otherwise evaluate risk.The summarized query results pertaining to an Associated Press articleshown in the information display area 4210 of FIG. 42, for example, maybe viewed by a user to determine that the “Benevolence HungerFoundation” may be associated with terrorists and/or terroristactivities.

In some embodiments, the screen display 4200 may also or alternativelyinclude a risk code field 4212. The risk code field 4212 may be orinclude, for example, a code and/or other information associated with adetermined, identified, and/or otherwise analyzed risk. The risk may beassociated with the query information provided by the user in the querysection 4202, for example. As shown in FIG. 42, the risk code field 4212may include information such as a code “VM” that may, for example,correspond to a certain type, quantity, and/or quality (e.g., magnitude)of risk. The field 4212 may also or alternatively include a descriptionof the code such as “Terrorist Related” as shown in FIG. 42. In someembodiments, the risk server 102, 202 and/or one of its associatedcomponents (e.g., the information matching engine 250, 1350, 1550, 3650,3850, 3950, 4150) may, for example, provide the risk code and/or riskdescription to populate the risk code field 4212.

Referring now to FIG. 43, a diagram of an exemplary screen display 4300according to some embodiments is shown. The screen display 4300 may beutilized in accordance with any of the systems 100, 200, 400, 600, 700,900, 1000, 1200, 1300, 1500, 3600, 3800, 3900, 4100 and/or any of themethods 300, 500, 800, 1100, 1400, 3700, 4000 described above. In someembodiments, the screen display 4300 may be presented on a user device106, 206, 1506, 3606, 3806, 3906, 4106 by a risk server 102, 202 and/orany components thereof (e.g., the information delivery engine 4160, theclient interface device 4164, etc.).

The various elements 4302, 4304, 4306, 4308, 4310, 4312, 4314 of thescreen display 4300 may be or include any type, quantity, and/orconfiguration of elements that are or become practicable. In someembodiments, the screen display 4300 may be similar to and/or otherwiseassociated with the screen display 4200 described above. The screendisplay 4300 may, according to some embodiments, include fewer or morecomponents and/or features than are shown in FIG. 43.

The screen display 4300 may include, according to some embodiments, aquery section 4302, one or more data entry fields 4304, a query resultsection 4306, one or more query result type selection boxes 4308, aninformation display area 4310, a risk code field 4312, and/or customerinformation 4314. In some embodiments, the components 4302, 4304, 4306,4308, 4310, 4312 of the screen display 4300 may be similar inconfiguration and/or functionality to the similarly-named componentsdescribed in conjunction with FIG. 42 above. The query section 4302 mayinclude, for example, one or more data entry objects and/or fields suchas the “Last Name/Business Name” text box 4304. Similarly, the queryresult section 4306 may include various result presentation mechanismsand/or objects such as the one or more query result type selection boxes4308, the information display area 4310, and/or the risk code field4312. In some embodiments (such as shown in FIG. 43), a user may enter arisk assessment query to evaluate the “Benevolence Hunger Foundation”(e.g., as entered into the text box 4304). The user may indicate, byselecting the “OFAC” query result type selection box 4308 for example,that the query results to be presented in the information display area4310 should include any information available from the OFAC (e.g., suchas an OFAC list). The query results shown in the information displayarea 4310 of FIG. 43 may, for example, be or include informationprovided by and/or otherwise associated with the OFAC. In someembodiments, the risk code displayed in the risk code field 4312 mayvary depending upon the result type selected by the user. As shown inFIG. 43 for example, the risk code “VT” may be, include, and/or beindicative of a risk code provided by the OFAC (e.g., “SpeciallyDesignated Individual”).

According to some embodiments, the screen display 4300 may includecustomer information 4314. For example, one or more fields and/oridentifiers may be included in the screen display 4300 that identify,track, and/or are otherwise associated with one or more customers orusers. As shown in FIG. 43, the customer information 4314 may include,according to some embodiments, a customer reporting identificationnumber and/or a customer tracking identification number. Suchinformation may be utilized, for example, to track a user's activityassociated with the risk server 102, 202. In some embodiments, thecustomer information 4314 may be used to audit user activities and/orprovide due diligence reports.

In FIG. 44, a method 4400 according to some embodiments is shown. Insome embodiments, the method 4400 may be conducted by and/or byutilizing any of the systems 100, 200, 400, 600, 700, 900, 1000, 1200,1300, 1500, 3600, 3800, 3900, 4100 described above and/or may beotherwise associated with any of the systems 100, 200, 400, 600, 700,900, 1000, 1200, 1300, 1500, 3600, 3800, 3900, 4100 and/or any of thesystem components (e.g., the risk server 102, 202) described inconjunction with any of FIG. 1, FIG. 2, FIG. 4, FIG. 6, FIG. 7, FIG. 9,FIG. 10, FIG. 12, FIG. 13, FIG. 15, FIG. 36, FIG. 38, FIG. 39, and/orFIG. 41 above. In some embodiments, the method 4400 may be or include aportion of and/or a procedure within and/or may be otherwise associatedwith other methods such as method 300 described above.

In some embodiments, the method 4400 may Begin at 4402 by detecting arisk investigation activity associated with a user. The detecting mayinclude, for example, recording, monitoring, and/or otherwiseidentifying user activity associated with any of the systems 100, 200,400, 600, 700, 900, 1000, 1200, 1300, 1500, 3600, 3800, 3900, 4100described herein. In some embodiments, user queries submitted to therisk server 102, 202 may, for example, be considered risk investigationactivities. According to some embodiments, a risk investigation activitymay be considered to take place every time a user logs onto and/orotherwise interacts with the risk server 102, 202 (and/or one of itscomponents). The risk investigation activity may be detected by anydevice and/or entity that is or becomes practicable. In some embodimentsfor example, the activity may be detected by the risk server 102, 202.According to some embodiments, the activity may be detected by adedicated audit device that may, for example, either be a stand-alonedevice or may be associated with or included within the risk server 102,202.

The method 4400 may continue by recording indicia of the riskinvestigation activity, at 4404. According to some embodiments, everyaction (and/or every important action) taken by a user duringinteraction with the risk server 102, 202 (and/or one of its components)may be recorded and/or stored (e.g., in the database system 240, 440,640, 1040, 1240, 1340, 1540, 3640, 3840). In some embodiments, atimestamp and/or user identification number may be recorded. Accordingto some embodiments, other information such as the content and/or typeof user query may also or alternatively be recorded (e.g., in an auditlog and/or database).

According to some embodiments, the method 4400 may continue at 4406 byreceiving a request for a due diligence report. The due diligence reportmay be requested, for example, by a user that has utilized the riskserver 102, 202 and/or otherwise investigated risk. In some embodiments,the user may request the due diligence report to satisfy due diligencerequirements associated with insurance, legal and/or regulatoryinvestigations, and/or other liabilities or compliance efforts. Therequest may be received, according to some embodiments, by the riskserver 102, 202 and/or one of its associated components.

The method 4400 may continue at 4408, for example, by providing the duediligence report based at least in part on the recorded indicia of riskinvestigation activity. The risk server 102, 202 may, according to someembodiments, create, compile, and/or otherwise identify and/or determinea due diligence report in accordance with, for example, the requestreceived at 4406. The risk server 102, 202 may then, according to someembodiments, provide the report to the user and/or to another entity, asrequired). In some embodiments, the reporting device 3962, 4162 of theinformation delivery engine 3960, 4160 may create and/or compile thereport. The reporting device 3962, 4162 may, for example, utilize auditinformation stored within and/or by the database system 240, 440, 640,1040, 1240, 1340, 1540, 3640, 3840 to determine risk investigation usageassociated with the user. The reporting device 3962, 4162 may then, forexample, send, transmit, and/or otherwise provide the report to the user(e.g., a user operating a user device 3906, 4106).

Referring now to FIG. 45, a block diagram of an apparatus 4500 accordingto some embodiments is shown. The apparatus 4500 may, for example, besimilar to and/or include a user device 106, 206, 1506, 3606, 3806,3906, 4106 described in conjunction with any of FIG. 1, FIG. 2, FIG. 15,FIG. 36, FIG. 38, FIG. 39, and/or FIG. 41 above. The apparatus 4500 may,according to some embodiments, be associated with and/or perform themethods 300, 500, 800, 1100, 1400, 3700, 4000, 4400 described inconjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11, FIG. 14, FIG.37, FIG. 40, and/or FIG. 44 above. In some embodiments, fewer or morecomponents than are shown in FIG. 45 may be included in the apparatus4500. In some embodiments, the apparatus 4500 may be or include and/orbe representative of a network device.

In some embodiments, the apparatus 4500 may be or include a computersuch as a computer server, computer workstation, PC, and/or any othertype or configuration of computational and/or logic device. According tosome embodiments, the apparatus 4500 may include a processor 4502, suchas one or more Intel® Pentium® processors, coupled to a communicationdevice 4504 configured to communicate via a communication network. Theprocessor 4502 may be or include any type or configuration of processor,microprocessors, and/or micro-engines that is or becomes known. In someembodiments, the apparatus 4500 may also or alternatively include aninput device 4506 (e.g., a mouse and/or keyboard), an output device 4508(e.g., a computer monitor), and/or a memory device 4510, an and/or anyof which may be in communication with the processor 4502.

The communication device 4504 may be used to communicate, for example,with the risk server 102, 202 as described in conjunction with any ofthe systems 100, 200 herein. The communication device 4504 may,according to some embodiments, be or include any type and/orconfiguration of communication device that is or becomes known. In someembodiments, the communication device 4504 may allow the apparatus 4500(and/or the processor 4502) to communicate with, for example, the riskserver 102, 202 (and/or one of its components) as described herein. Theinput device 4506 and the output device 4508 may be or include one ormore conventional devices such as displays, printers, keyboards, amouse, a trackball, etc. The devices 4506, 4508 may be utilized, forexample, by an operator and/or user to submit risk evaluation queriesand/or to otherwise retrieve and/or obtain information associated withrisk. In some embodiments, the system may be configured as a stand-aloneor client side device operated as an “interdiction” device allowing auser to perform searches and perform analyses of transactions or otherqueries.

As used herein, information may be “received” by or “transmitted” to,for example: (i) the apparatus 4500 from another system and/or device;or (ii) a software application or module within the apparatus 4500 fromanother apparatus and/or system, software application, module, and/orany other source. For example, information (e.g., associated with riskand/or to be evaluated for risk) that is processed by the processor 4502may be sent via the communication device 4504 to the risk server 102,202.

In some embodiments, the processor 4502 may also or alternativelycommunicate with the memory device 4510. The memory device 4510 may beor include, according to some embodiments, one or more magnetic storagedevices, such as hard disks, one or more optical storage devices, and/orsolid state storage. The memory device 4510 may store, for example,operating systems 4512, device drivers 4514, applications (e.g., a webbrowser 4516), and/or programs, procedures, and/or modules. Theoperating system 4512 may, for example, store instructions allowing theprocessor 4502 to communicate with and/or manage the various components4504, 4506, 4508, 4510 of the apparatus 4500. Similarly, the devicedrivers 4514 may include instructions allowing the processor 4502 and/orthe apparatus 4500 to communicate with and/or interface with (e.g.,using the communication interface 4504) other apparatus, devices, and/orsystems. In some embodiments, the device drivers 4514 may be or includedrivers such as database drivers that allow and/or facilitate thestoring of information in, on, and/or by the memory device 4510.

In some embodiments, the memory device 4510 may store one or moreprogram applications such as the web browser 4516. The web browser 4516may generally allow the apparatus 4500 to interface with variousnetworks and/or network devices operating in accordance with theTransfer Control Protocol (TCP) and/or Internet Protocol (IP). Accordingto some embodiments, the web browser 4516 may allow a user operating theapparatus 4500 to interface with the risk server 102, 202 and/or theinformation delivery engine 260, 1560, 3660, 3860, 3960, 4160 and/or anycomponents thereof (e.g., the client interface device 3964, 4164). Forexample, a user operating the apparatus 4500 may utilize the web browser4516 to submit risk evaluation queries and/or to receive informationassociated with risk (e.g., risk evaluation query results).

The memory device 4510 may, according to some embodiments, store aprogram such as the risk management program 4518 for controlling theprocessor 4502. The processor 4502 may perform instructions of the riskmanagement program 4518, and for example, thereby operate in accordancewith embodiments described herein. The risk management program 4518 maybe stored in a compressed, un-compiled and/or encrypted format. In someembodiments, the risk management program 4518 may, for example, besimilar in functionality and/or configuration to the risk server 102,202 and/or any of its components as described herein. In someembodiments, the risk management program 4518 may operate in accordancewith the methods 300, 500, 800, 1100, 1400, 3700, 4000, 4400 describedin conjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11, FIG. 14,FIG. 37, FIG. 40, and/or FIG. 44 above. According to some embodiments,the risk management program 4518 may be or include a client-sideapplication configured to communicate with, for example, the risk server102, 202. In some embodiments, the risk management program 4518 may notbe required and/or included within the apparatus 4500. For example, theapparatus 4500 may communicate with another device such as the riskserver 102, 202 to perform risk assessment and/or risk analysis queries.

Turning finally to FIG. 46, a block diagram of an apparatus 4600according to some embodiments is shown. The apparatus 4600 may, forexample, be similar to and/or include the risk server 102, 202 (and/orany one or combination of its components) as described in conjunctionwith any of the systems 100, 200, 400, 600, 700, 900, 1000, 1200, 1300,1500, 3600, 3800, 3900, 4100 herein. The apparatus 4600 may, accordingto some embodiments, be associated with and/or perform the methods 300,500, 800, 1100, 1400, 3700, 4000, 4400 described in conjunction with anyof FIG. 3, FIG. 5, FIG. 8, FIG. 11, FIG. 14, FIG. 37, FIG. 40, and/orFIG. 44 above. In some embodiments, fewer or more components than areshown in FIG. 46 may be included in the apparatus 4600. In someembodiments, the apparatus 4600 may be or include and/or berepresentative of a network device.

In some embodiments, the apparatus 4600 may be or include a computersuch as a computer server, computer workstation, PC, and/or any othertype or configuration of computational and/or logic device (e.g., a webserver). According to some embodiments, the apparatus 4600 may include aprocessor 4602, such as one or more Intel® Pentium® processors, coupledto a communication device 4604 configured to communicate via acommunication network. The processor 4602 may be or include any type orconfiguration of processor, microprocessors, and/or micro-engines thatis or becomes known. In some embodiments, the apparatus 4600 may also oralternatively include an input device 4606 (e.g., a mouse and/orkeyboard), an output device 4608 (e.g., a computer monitor), and/or amemory device 4610, all and/or any of which may be in communication withthe processor 4602.

The communication device 4604 may be used to communicate, for example,with a user device 106, 206, 1506, 3606, 3806, 3906, 4106 such as isdescribed in conjunction with any of FIG. 1, FIG. 2, FIG. 15, FIG. 36,FIG. 38, FIG. 39, and/or FIG. 41 above. The communication device 4604may, according to some embodiments, be or include any type and/orconfiguration of communication device that is or becomes known. In someembodiments, the communication device 4604 may allow the apparatus 4600(and/or the processor 4602) to communicate with, for example, the userdevice 106, 206, 1506, 3606, 3806, 3906, 4106 (and/or one of itscomponents) as described herein. The input device 4606 and the outputdevice 4608 may be or include one or more conventional devices such asdisplays, printers, keyboards, a mouse, a trackball, etc. The devices4606, 4608 may be utilized, for example, by an operator and/or user tomanage, assess, provide, and/or otherwise process information associatedwith risk.

In some embodiments, the processor 4602 may also or alternativelycommunicate with the memory device 4610. The memory device 4610 may beor include, according to some embodiments, one or more magnetic storagedevices, such as hard disks, one or more optical storage devices, and/orsolid state storage. The memory device 4610 may store, for example,operating systems 4612, device drivers 4614, information (e.g., riskinformation 4616), and/or programs, procedures, and/or modules. Theoperating system 4612 may, for example, store instructions allowing theprocessor 4602 to communicate with and/or manage the various components4604, 4606, 4608, 4610 of the apparatus 4600. Similarly, the devicedrivers 4614 may include instructions allowing the processor 4602 and/orthe apparatus 4600 to communicate with and/or interface with (e.g.,using the communication interface 4604) other apparatus, devices, and/orsystems (e.g., the database system 240, 440, 640, 1040, 1240, 1340,1540, 3640, 3840). In some embodiments, the device drivers 4614 may beor include drivers such as database drivers that allow and/or facilitatethe storing of information in, on, and/or by the memory device 4610(and/or by the database system 240, 440, 640, 1040, 1240, 1340, 1540,3640, 3840).

In some embodiments, the memory device 4610 may store variousinformation such as information associated with risk (i.e., riskinformation 4616). The risk information 4616 may, according to someembodiments, be or include any type, quantity, and/or configuration ofinformation associated with risk that is or becomes known. For example,the risk information 4616 may include information stored within a datastorage structure that is configured to facilitate the identification ifrisk. The risk information 4616 may be stored, for example, in any ofthe data storage structures 1600, 1700, 1800, 1900, 2000, 2100, 2200,2300, 2400, 2500, 2600, 2700, 2800, 2900, 3000 described herein. In someembodiments, the memory device 4612 may be or include the databasesystem 240, 440, 640, 1040, 1240, 1340, 1540, 3640, 3840.

The memory device 4610 may, according to some embodiments, store aprogram such as the risk management program 4618 for controlling theprocessor 4602. The processor 4602 may perform instructions of the riskmanagement program 4618, and for example, thereby operate in accordancewith embodiments described herein. The risk management program 4618 maybe stored in a compressed, un-compiled and/or encrypted format. In someembodiments, the risk management program 4618 may, for example, besimilar in functionality and/or configuration to the risk server 102,202 and/or any of its components as described herein. In someembodiments, the risk management program 4618 may operate in accordancewith the methods 300, 500, 800, 1100, 1400, 3700, 4000, 4400 describedin conjunction with any of FIG. 3, FIG. 5, FIG. 8, FIG. 11, FIG. 14,FIG. 37, FIG. 40, and/or FIG. 44 above. For example, the apparatus 4600may receive a risk evaluation query from a user and may, utilizing therisk management program 4618, assess, identify, and/or otherwisedetermine or analyze risk.

The several embodiments described herein are solely for the purpose ofillustration. Those skilled in the art will note that varioussubstitutions may be made to those embodiments described herein withoutdeparting from the spirit and scope of the present invention. Thoseskilled in the art will also recognize from this description that otherembodiments may be practiced with modifications and alterations limitedonly by the claims.

1. A method, comprising: receiving information from one of a pluralityof sources; generating an intermediate output file having apredetermined format; comparing, using a processor, portions of theintermediate output file with a set of risk data to determine a riskrelevancy of information in the intermediate output file; tagging theportions of the intermediate output file having a desired riskrelevancy; and storing the tagged portions of the intermediate outputfile in a database.
 2. The method of claim 1, further comprising:comparing the tagged portions of the intermediate output file with datapreviously stored in the database to determine that the tagged portionsare not redundant.
 3. The method of claim 1, wherein the storing furthercomprises: storing the tagged portions in a data structure arranged tofacilitate the identification of risk.
 4. The method of claim 1, whereinthe information is received from a web site, the method furthercomprising: monitoring the web site for a change; and extracting theinformation from the web site.
 5. The method of claim 1, furthercomprising: receiving second information from a second of a plurality ofsources; determining that the second of a plurality of sources is apre-qualified source; and directly storing the second information in thedatabase without further determining a risk relevancy of the secondinformation.
 6. The method of claim 1, further comprising: deletingportions of the intermediate file lacking a desired risk relevancy. 7.The method of claim 1, further comprising: receiving a search requestfrom a user, the search request having a search term specifying at leastone of an individual name or an entity name; searching the database forthe search term; and returning a search result to the user, the searchresult including risk information associated with the search term. 8.The method of claim 8, wherein the search request and the search resultsare provided via a network interface.
 9. The method of claim 1, furthercomprising: generating an alert notification if the tagged portions ofthe intermediate output file meet predetermined alert criteria.
 10. Themethod of claim 9, further comprising: automatically transmitting thealert notification to at least a first predetermined recipient.
 11. Asystem, comprising: a processor; and a storage device in communicationwith the processor and storing instructions adapted to be executed bysaid processor to: receive information from one of a plurality ofsources; generate an intermediate output file having a predeterminedformat; compare portions of the intermediate output file with a set ofrisk data to determine a risk relevancy of information in theintermediate output file; tag the portions of the intermediate outputfile having a desired risk relevancy; and store the tagged portions ofthe intermediate output file in a database.
 12. At least one tangiblecomputer-readable medium carrying instructions, which when executed byat least one processor, determines risk relevancy of information,comprising: receiving information from one of a plurality of sources;generating an intermediate output file having a predetermined format;comparing portions of the intermediate output file with a set of riskdata to determine a risk relevancy of information in the intermediateoutput file; tagging the portions of the intermediate output file havinga desired risk relevancy; and storing the tagged portions of theintermediate output file in a database.
 13. The at least one tangiblecomputer-readable medium of claim 12, wherein the instructions, whichwhen executed by the at least one processor, further comprise: comparingthe tagged portions of the intermediate output file with data previouslystored in the database to determine that the tagged portions are notredundant.
 14. The at least one tangible computer-readable medium ofclaim 12, wherein the instructions to store the tagged portion furthercomprise: storing the tagged portions in a data structure arranged tofacilitate the identification of risk.
 15. The at least one tangiblecomputer-readable medium of claim 12, wherein the information isreceived from a web site, wherein the instructions, which when executedby the at least one processor, further comprise: monitoring the web sitefor a change; and extracting the information from the web site.
 16. Theat least one tangible computer-readable medium of claim 12, wherein theinstructions, which when executed by the at least one processor, furthercomprise: receiving second information from a second of a plurality ofsources; determining that the second of a plurality of sources is apre-qualified source; and directly storing the second information in thedatabase without further determining a risk relevancy of the secondinformation.
 17. The at least one tangible computer-readable medium ofclaim 12, wherein the instructions, which when executed by the at leastone processor, further comprise: deleting portions of the intermediatefile lacking a desired risk relevancy.
 18. The at least one tangiblecomputer-readable medium of claim 12, wherein the instructions, whichwhen executed by the at least one processor, further comprise: receivinga search request from a user, the search request having a search termspecifying at least one of an individual name or an entity name;searching the database for the search term; and returning a searchresult to the user, the search result including risk informationassociated with the search term.
 19. The method of claim 18, wherein thesearch request and the search results are provided via a networkinterface.
 20. The at least one tangible computer-readable medium ofclaim 12, wherein the instructions, which when executed by the at leastone processor, further comprise: generating an alert notification if thetagged portions of the intermediate output file meet predetermined alertcriteria.